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INSPECLOR GENERAL OF ‘HE INTELLIGENCE COMMUNITY 


WASHINGTON, DC 20511 
July 6, 2015 


Mr. Randall Coleman - 

Assistant Director, Counterintelligence Division 
Federal Bureau of Investigation 

935 Pennsylvania Ave., N.W. 

Washington, DC 20535 


SUBJECT: Section 81 1(c) Referral — Potential Compromise of Classified 
Information 


SENT VIA SECURE FACSIMILE 
Dear Mr. Coleman, 


(U) On March 12, 2015, Senate Committee Chairmen Burr, Corker, and © 
Johnson requested that the State Department Inspector General (State 1G) 
conduct a review of State employees’ use of personal email and non-government ° 
networks for official purposes. The Chairmen asked State IG to address several 
specific areas, including whether classified information was transmitted or 
received. The Chairmen also requested State IG coordinate their review with the 
Inspector General of the Intelligence Community (IC IG). State IG thereafter 
initiated a review and requested IC IG support. 


(U) Concomitant with the State IG review, State FOIA officials are reviewing 
more than 30,000 emails provided by former Secretary of State 
Hillary Clinton. According to the former Secretary, these 30,000 emails were 
transmitted via personal hardware and software devices during her tenure at 
State. 


(U//¥O¥S) In support of State IG’s review, IC IG reviewed 296 of the 
30,000 emails. State had FOIA-processed these 296 emails and released them 
publicly on May 22, 2015. IC IG found that two of these 296 emails contained 
classified information. One email had been redacted using a “B1” FOIA 
Exemption. The other email had been processed and released in an unclassified 


UNCLASSIFIED / /FEe8e- 


HRC-351 


_ UNCLASSIFIED/ /Beue 


Mr. Randall Coleman 


and unredacted form. This second email should have been marked 
SECRET//SI//REL USA, FVEY according to FOIA officials at the 

Defense Intelligence Agency (DIA), National Geospatial-Intelligence Agency (NGA), 
and National Security Agency (NSA). These Intelligence Community FOIA officials 
confirmed that State FOIA officials did not coordinate with them in regard to the 
public release of this second email. 


(U//FE8O) As part of its review, State IG sent former Secretary Clinton’s 
personal attorney, Mr. David E. Kendall, a preservation request regarding systems 
and devices related to the 30,000 emails. IC IG co-signed this request. 

Mr. Kendall replied to the request (see enclosure), and noted that he had stored 
electronic copies of all 30,000 emails on a thumb drive located in his law 

office. Mr. Kendall also noted that the former Secretary's personal server is in the 
custody of a company named “Platte River Networks.” 


(U//FOCS) As the thumb drive and personal server contain classified 


information and are not currently in the Government's possession, we are referring 
this matter to your office for any action you deem appropriate. - 


(U)’ Please do not hesitate to contact me, 7 | with any b3 per ODNI 
questions or concerns. 


Sincerely, 


AEA] Cage 


I. Charles McCullough, III 


Enclosure: As stated 
CC: The Honorable James R. Clapper 


The Honorable Steve A. Linick 
' Mr. William R. Evanina 


2 


UNCLASSIFIED//Fexve 


» “¢ —-HRC-352 


ALL 


DAVID E. KENDALL PAUL R. CONNOLLY (1922-1978) 


. dkendali@we.com 


HPORMATION CONTAINED 


RESEIN [8 UNCUASS IE IED 
DATE 10-27-2016 BY J3'ose7Ts4 NSICc Ref MSI Ts Rape ae ERTS Maa SA abe ae 


LAW OFFICES 
WILLIAMS & CONNOLLY LLP 
725 TWELFTH STREET, N.W. 
WASHINGTON, D. C. 20005-5901 EDWARD BENNETT WILLIAMS (1920-1D84) 
(202) 434-5145 — (202) 434-5000 
FAX (202) 434-5029 


Sune 24, 2015 


BY ELECTRONIC MAIL 
b6 
b7C 
Office of Inspector General 
US. ——— of State 
b6 
Dea] D7 


I write as personal counsel to former Secretary Clinton in response to your June 9 
e-mail request for additional details regarding our preservation efforts related to Secretary 
Clinton’s work-related e-mail from her tenure as Secretary of State. 


I note at the outset that the Department of State is in possession of all of Secretary 
Clinton’s work-related and potentially work-related e-mails. Specifically, in response to 
an October 2014 letter request from the Department of State, Secretary Clinton’s counsel 
identified all work-related or potentially work-related e-mail in her possession, custody, 
or control. In total, 30,490 e-mails, all of which were from her 
@clintonemail.com account, were identified and provided in hard copy to the Department 
of State in December 2014. As her personal counsel, we continue to retain a preservation 
copy of the .pst file containing the electronic copies of those e-mails, on a thumb drive 
that is stored in a secured safe at the offices of Williams & Connolly LLP, 725 12th | 
Street NW, Washington DC 20005. The only two persons authorized to access that 
thumb drive are me and my law partner, Katherine Turner. 


In addition, we have taken steps to retain the server equipment that hosted 
Sccretary Clinton’s @clintonemail.com account during her tenure as Secretary of State, 
even though that equipment is no longer active and, we believe, no longer contains any 
data from Secretary Clinton’s @clintonemail.com account. The equipment is in the 
custody of Platte River Networks and is maintained at a secure data center. In response 
to preservation notices related to Secretary Clinton’s e-mail reccived that I have received 
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a certain entities, I have confirmed Platte River Networks’s receipt of such notices as 
Wwe. 3 F é 


re b3 per ODNI : 
° b6 per ODNI, FBI § 
b7C per ODNI, FBI] 


HRC-354 


ALL 2B. [NSUCBLATIOCN CONTAIN 
HESEIN 15 UNCLASS uO 
DATE 10-27-2016 BY Gsig85754 NSlo: 


UNCLASSIFIED/ /Foue 


INSPECTOR GENERAL OF THE INTELLIGENCE COMMUNITY 
WASHINGTON, DC’ 20511 


MEMORANDUM FOR: . SEE DISTRIBUTION 


SUBJECT: | Update to IC IG support to State Department IG. 
(Re: 12 March 2015 letter from Chairmen Burr, 
Corker, and Johnson) 


(U/ AFOBS) On 12 March 2015, the Inspector General of the State Department 
(State IG) received a letter from Chairmen Burr, Corker, and Johnson asking 
for, among other requests, a review of State Department employees’ usage of 
personal email for official purposes. The letter also requested State IG to 


" coordinate with my office to determine whether classified information was 


transmitted or received by State Department employees over personal systems. 


. On April 16, 2015, State IG initiated a review of the use of personal 


communications hardware and software by five Secretaries of State and their 
immediate staffs. 


- (U//FOUC) In December 2014, former Secretary Clinton provided the 


State Department with approximately 55,000 pages of electronic documents. 
These documents were deemed to be official business, and had been 
transmitted via personal communications hardware and software. The State 
Department is in the process of reviewing these documents for potential public 
release in response to Freedom of Information Act (FOIA) requests. 


(U//FOBO) State IG asked my office to validate the procedures being used by 
State Department FOIA staff as they process the 55,000 pages of electronic 
documents. Our preliminary assessment of the FOIA pre-release process 
determined that State Department FOIA staff lacked sufficient familiarity with 
Intelligence Community (IC) equities to properly identify potentially classified 
information. We provided State IG with some recommendations, and State IG 
forwarded our recommendations to the State Department FOIA staff. One of 
our recommendations was that State Department FOIA staff request 

support from IC FOIA officials to better protect potentially classified 
information. . , 


(U//FEUO) My staff also reviewed 296 emails released by State FOIA officials on 
22 May 2015. We identified one document that had been released in an 
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SUBJECT: Update to IC IG support to State Department IG (Re: 12 March 2015 letter from 
Chairmen Burr, Corker, and Johnson) ; 


unclassified and unredacted form that --according to DIA, NSA, and NGA FOIA 
officials -- should have been marked and handled as SECRET/ /NOFORN. 
Further, these IC FOIA officials confirmed that the document in question had not 
been coordinated with the appropriate IC elements before public release. 


(U/ APES) My office notified the National Counterintelligence and Security 
Center (NCSC) as well as other appropriate Cl /Security officials of this 
released, unredacted document. Under Intelligence Community Directive 701, 
Deterrence, Detection, Reporting, and Investigation of Unauthorized Disclosures 
of Classified National Intelligence., NCSC (formerly National Counterintelligence 
Executive) is responsible for assessing unauthorized disclosures of classified 
information and making any notifications they deem necessary to the 
Department of Justice. 


: b3 per ODNI 
nee any questions or concerns. b7C per ODNI 


G-F- 2S 


Date 


DISTRIBUTION: The Honorable Richard Burr 
The Honorable Dianne Feinstein 
The Honorable Devin Nunes 
The Honorable Adam Schiff 
The Honorable James Clapper, Director National Intelligence 
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INSPECTOR GENFRAL OF THE INTELLIGENCE COMMUNITY 
WASHINGTON, DC 20511 


MEMORANDUM FOR: DISTRIBUTION 


SUBJECT: | Classified Material on Personal Electronic 
Storage Devices 


(U//FOU9) On 19 June 2015 my office notified your committees that we 
had recently assessed the Freedom of Information Act (FOIA) document review 
process at the Department of State (State). This assessment was limited to the 
ongoing process being used by State FOIA officials reviewing almost 55,000 
pages of emails that had been provided to State by former Secretary of State 
Clinton. These emails had previously existed on, and had been transmitted 
via, a non-government communication system but were deemed to be official 
business by former Secretary Clinton’s staff. 


(U//FEUS) As part of our assessment, we also reviewed a subset of these 
same documents, some 296 emails, that had already been reviewed and 
released by State FOIA officials in response to several FOIA requests. 
According to DIA, NSA, and NGA FOIA officials — at least one of these 
unredacted emails should have been marked and treated as 
SECRET//NOFORN. 


(U//FOUSO) On 24 June 2015, the State Inspector General received the 
attached letter from former Secretary Clinton’s personal counsel, 
David Kendall. This letter discusses the former Secretary’s provision of 
documents from her personal server to State; the current location of the 
personal server; and information about a mobile electronic storage device 


_ (thumb drive) presently in her counsel’s possession. The above-mentioned 


SECRET//NOFORN document is likely on the thumb drive and possibly on the 


personal server (although Mr. Kendall notes he believes the personal server no 
longer contains any data). : 


(U/ /FOUO) Given the likelihood that classified material may exist on at 


‘least one unsecured, non-government system, the IC IG and State IG 


immediately notified security officials at ODNI, State, DIA, NSA, and NGA in 
accordance with Intelligence Community Directive 701, Deterrence, Detection, 
Reporting, and Investigation of Unauthorized Disclosures of Classified National 
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© UNCLASSIFIED/ /FOoue- @ 
SUBJECT: Classified Material on Personal Electronic Storage Devices 


Intelligence. The State and IC IG defer to the National Counterintelligence and 

Security Center and the various agency security officials with regard to b3 per ODNI 
coordination of appropriate security/CI actions and the disposition of these »6 per ODNI 
electronic storage devices. b7C per ODNI 


U) Please contact me or th 
with any questions or concerns. 


A JesS eo 


Date 


I. Charles McCullough, II 
Inspector General of the Intelligence Community 


DISTRIBUTION: The Honorable Richard Burr 
The Honorable Dianne Feinstein 
The Honorable Devin Nunes 
The Honorable Adam Schiff 
The Honorable James Clapper, Director National Intelligence 
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U!S. Department of State ’ SUBJECT TO 
ripe ; AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 


Doc No. CO5739666 


Date: 05/13/2015 | . RELEASE IN 
FULL 


NR SS SC ts 


From: Abedin, Huma <AbedinHi@state.gov> 

Sent: Sunday, April 10, 2011 10:14 AM BLL FBE INSORUATION comparven 

Te: H : HEREIN 15 UNCLASSIZIE0 

Subject: Fw: Stevens Update (important) DATE 10-27-2016 BY 337985794 NSICG 
importance: High 

Jake may have sent but in case noi... 

---- Original Message ——- 

From: Davis, Tinmy TF 


Sent: Sunday, April 210, 2011 06:48AM 
To: Sullivan, Jacob J; Abedin, Huma; Wells, Alice G; S_SpecialAssistants 
Subject: Stevens Update {iraportant} 


{584} Per Spacial Envoy Stevens: 


The situation in Ajdabiyah has worsened to the point where Stevens is considering departure from Benghazi. The 


envoy’s delegation is currently doing a phased checkout (paying the hotel bills, moving some comms to the boat, 


etc}. He will monitor the situation to see if it deteriorates further, but ne decision has been made on departure. He will 


wait 2-3 more hours, then ravisit the decision on departure. 


He received reports of shelling last night in Ajdabiyah as well as snipers shooting people in the city. AFRICOM . 


reported Qadhafi’s forces took the eastern and western gates of Ajdablyah, with 5 vehicles at the eastern gate and 50 at 


the western gate. More Qadhafi forces are heading to Ajdabiyah from Brega. 


The Brits report Qadhafi forces are moving from Sirte to Brega, which they interpret as preparation for another 


assault on Ajdabiyah today. 


He plans to discuss the situation further with the Brits, Turks, and the TNC to see if this is an irreversible 


Situation. Departure would send a significant polltical signal, and woutd be interpreted as the U.S. losing confidence in 
the TNC. Initial message to the TNC would frame the Gepertre as due to security grounds and as a temporary measure 


only. 


Polaschik said she would discuss these developments with Amb. Cretz. 


if the group departs, the contract for the boat stipulates they return ta Greece. One scenario could be the group 


Stages elsewhere for a few days. 


Ops will continue to monitor the situation. 
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Case No. F-2015-04841 
Doc No. COS739666 STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 
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June 24, 2015 
BY ELECTRONIC MAIL 


, bE 
Office of Inspector General 


U.S. Department of State 


; ; b6 
I write as personal counsel to former Secretary Clinton in response to your June 9 


e-mail request for additional details regarding our preservation efforts related to Secretary 
Clinton’s work-related e-mail from her tenure as Secretary of State. 


I note at the outset that the Department of State is in possession of all of Secretary 
Clinton’s work-related and potentially work-related e-mails. Specifically, in response to 
an October 2014 letter request from the Department of State, Secretary Clinton’s counsel 
identified all work-related or potentially work-related e-mail in her possession, custody, 
or control. In total, 30,490 e-mails, all of which were from her 
@clintonemail.com account, were identified and provided in hard copy to the Department 
of State in December 2014. As her personal counsel, we continue to retain a preservation 
copy of the .pst file containing the electronic copies of those e-mails, on a thumb drive 
that is stored in a secured safe at the offices of Williams & Connolly LLP, 725 12th 
Street NW, Washington DC 20005. The only two persons authorized to access that 
thumb drive are me and my law partner, Katherine Turner. 


_ In addition, we have taken steps to retain the server equipment that hosted 
Secretary Clinton’s @clintonemail.com account during her tenure as Secretary of State, 
even though that equipment is no longer active and, we believe, no longer contains any 
data from Secretary Clinton’s @clintonemail.com account. The equipment is in the 
custody of Platte River Networks and is maintained at a secure data center. In response 
to preservation notices related to Secretary Clinton’s e-mail received that I have received 
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she certain entities, I have confirmed Platte River Networks’s receipt of such notices as 
well. 


Ce: b3 per ODNI - 
; b6 per ODNI, FBI 


b7C per ODNI, FBI 
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SECRET//NOFORN_ 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE Date: 07/24/2015 


To: ‘CD-4, Counterespionage Section Attn: 


From: CD-4 


b6 
“Contact: SA b7C 
Approved By: Kable Charles H. IV “a 
4ral' 
Drafted By: 
: b3 
Case ID #: (U) <ul A | og 


fF) MIDYEAR EXAM 


Synopsis: ©) (Shae) Document July 22, 2015 Meeting with Office of 
Inspector General of the Intelligence Community. ~ 


b3 per ODNI 
b6 per FBI, ODNI 
b7C per FBI, ODNI 


Details: '(SAANF) On July 22, 2015, FBI representatives 
Charles H. Kable, Section Chief, Assistant 
Section Chief, Assistant Section Chief, CD-4 
Counter-Espionage Section, Special Agents 


Intelligence Analysts an 
met with Office of the Inspector General of the 
Intelligence Communi j 


The meeting took place at the Office of 
the Inspector General of the Intelligence Community, Patriot 
Park, 12290 Sunrise Valley Drive, Reston, VA 20191. 


“(SAAIE) At this meeting the group discussed the U.S. 
Department of State’s Inspector General’s (State IG) and Office 
of the Inspector General of the Intelligence Community (ICIG) 
ongoing review of the use of personal communications hardware 
and software by five Secretaries of State and their immediate 


SEC ORN 
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(Rev. 05-01-2008) 


¢ ° 


FEDERAL BUREAU OF INVESTIGATION 


staffs. ICIG informed the FBI that ICIG had several meetings 
with STATE IG and U.S. STATE Department (USDS) officials 
regarding the ongoing inquiry. ICIG believed that subject’s 
personal server was established approximately 1 day after 
subject took her official position at the USDS. ICIG had several 
meetings and correspondence with Patrick Kennedy, Under 
Secretary of State For Management and others at USDS. On or 
about June 15, 2015, ICIG sent a letter to State IG to document 
potential issues identified in the preliminary review of the 
State Department FOIA process and made four recommendations. 
USDS agreed to the recommendation to get additional Intelligence 
Community officials involved in the FOIA review. 


Uh O87 eR ICIG informed FBI that when an employee leaves 
employment’ at USDS, the agency burns a .PST file of that 
employee’s electronic account. ICIG surmised that subject had 2 
Blackberry accounts and at least 2 @Clinton e-mail addresses. 
ICIG was going to complete a Congressional notification and 
would provide the FBI a copy upon completion. ICIG was legally 
compelled to provide this Congressional notification to the 
Senate Judiciary Committee as part of its Inspector General 
oversight responsibilities. 


(Ch ( AXE) ICIG intended on briefing Charles Grassley, 
Chairman, a on the Judiciary on Friday, July 24, 2015 
and was going to inform him that a referral was made. As of July 
22, 2015, ICIG identified 5 classified documents in _ the engeins 
review of subject’s e- ~mail. 


Ud AB ICIG also provided copies of e-mail from two 
potential complainants for the FBI’s review. ICIG reminded the 
FBI to “PROTECT IDENTITY” of individuals referenced in 
whistleblower process. 


o¢ 
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Precedence: ROUTINE Date: 07/28/2015 
To: CD-4, Counterespionage Section . Attn: 


From: CD-4 


: : b6 


Approved By: Kable Charles H. ww Yu Af 


ey 
Drafted By: 


, ; b3 
Case ID #: (U) aa cui \O b7E 


_ MIDYEAR EXAM 


Title: . 
Synopsis: eee Receipt of Correspondence between 
Inspector General for the Intelligence Community, Department of 
State Inspector General and U.S. Department of State. 


i 


By: F93M27K51 _— 
dated 20130301 


ify On: 20401231 
iW) 


Details: [s#ee] on July 27, org 
Office of the Inspector General of the Intelligence Community b3 per ODNI 


(ICIG) provided the FBI documented correspondence records __b6 per ODNI 
between ICIG, Department of State Inspector General (State IG) b7¢ per ODNI 
and U.S. Department of State (USDS). 


1. June 15, 2015: Letter from ICIG to State IG 

2. June 15, 2015: Memo from ICIG documenting potential FOIA 
_ issues 

3. June 25, 2015: Memo from Secretary Kennedy response to FOIA ° 

issues memo : 

. June 29, 2015: Memo from State IG to Secretary Kennedy 

. June 29, 2015: Follow Up Memo Email 

. July 2, 2015: Follow up from Yesterday’s Meeting Email 

. July 2, 2015: Follow up from Yesterday’s Meeting Email 

. July 6, 2015: Request for assistance from IC FOIA Officials 
Email ; ; 


on now sb 
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9: July 6, 2015: Request for assistance from IC FOIA 
Officials 

10: July 6, 2015: Follow Up From Yesterday’s Meeting Email 

Ae ie July 7, 2015: Follow Up From Yesterday’s Meeting Email 

12. July 10, 2015: Memo from State IG & ICIG to Secretary 
Kennedy 

13. July 22, 2015: Memo from Secretary Kennedy to State IG 


regarding “Your request for Electronic Copy of Former 
Secretary Clinton’s Emails”. 


o¢ 
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INSPECTOR GENERAL OF THE INTELLIGENCE COMMUNITY 
WASHINGTON, DC 20511 


15 June 2015 


- The Honorable Steve Linick 
Inspector General 

Department of State 

2201 C Street, NW (SA-3, Suite 8100) 
Washington, DC 20520 


Dear Mr. Linick: 


(U//FES) Thank you for reaching out to my office to assist you in your 
current review entitled “Use of Personal Communications Hardware and Software 
by Five Secretaries of State and Their Immediate Staffs.” Thus far, our assistance 
has been tailored to reviewing State Department’s Freedom of Information Act 
(FOIA) process and how classified information is safeguarded in that process. 


(U/ /FEUCE} Our preliminary review identified four areas that may require 
immediate attention by State FOIA officials, in coordination with Intelligence 
Community FOIA officials. Those areas are detailed in the attached memorandum. 
My team has briefed your team members on these developments and will continue 
to refine findings and recommendations as the review progresses. 


Sincerely, 


SI CB 


I. Charles McCullough, III 


bé6é 
cc: [| Counselor, b7c 
State Department Office of Inspector General 


_ 5 the Inspector — 5 = Intelligence Community BS. Per -OENT 
b6 per ODNI 
Attachment: . b7C per ODNI 
(U) MFR, td 15 June, 2015) (U//FE8S) 
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OFFICER OF THE INSPECTOR GENERAL OF THE INTELLIGENCE COMMUNITY 
INSPECTIONS AND EVALUATIONS DIVISION 
WASHINGTON, DC 20511 


MEMORANDUM FOR THE RECORD 


15 June 2015 


PROJECT: (U) Special Inquiry 2015-001: Assistance to State 
Department Inspector General Review of Use of Personal 
Communications Hardware and Software by Five 
Secretaries of State and Their Immediate Staffs 


INSPECTOR: mT ba per ODNI 


b6 per ODNI 


PURPOSE: (U//¥E80) Document Potential Issues Identified in ©7¢ Per ODNI 
Preliminary Review of the State Department FOIA 
Process. 


(U/ H*@U8) The Office of the Inspector General of the Intelligence 
Community (IC IG) is assisting the State Department IG’s office in the above 
referenced review; focused on the handling of potentially classified material during 
the State Department Freedom of Information Act (FOIA) review process. I am 
conducting a preliminary review of the handling of potentially classified material 
during the State FOIA review process being used to review the 33,000 emails 
provided by former Secretary Clinton from her personal email server. Thus far, I 
have identified four areas that may require expedited attention by State FOIA 
officials, in coordination with IC FOIA officials. Those areas are: 


1. (U//FOS) Evaluation of other agencies’ equities is not optimal. State 
Department is currently relying on retired senior Foreign Service Officers to 
review for other agencies’ equities in FOIA cases. For example, a review of 
the first set of 296 emails received from former-Secretary Clinton and 
released on the State Department FOIA website identified material that 
should have been referred to IC FOIA officials for review prior to release. 
Recommend State Department FOIA Office request staff support from 
IC FOIA offices to assist in the identification of intelligence community 
equities. 


THIS IS A DELIBERATIVE PROCESS DOCUMENT AND INTENDED SOLELY FOR OFFICIAL USE BY THE IC IG. 
RECIPIENTS MAY NOT FURTHER DISSEMINATE WITHOUT THE EXPRESS PERMISSION OF IC IG PERSONNEL. 


UNCLASSIFIED//Ee8e 
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(U/ /FES) Document Potential Issues Identified in Preliminary Review of the 
State Department FOIA Process. - 


UNCLASSIFIED//FOUS @ 


2. (U//FEUS) Storage and distribution of FOIA material is occurring on a 
SECRET level network. State Department is using a SECRET level 
network (ClassNet) to store the 33,000 emails acquired from former- 
Secretary Clinton. State is also using ClassNet to distribute the FOIA 
material for review by both the intra-and-inter-agency. Material at the 
SECRET//NOFORN level was identified in the first set of 296 emails prior to 
their release. Recommend IC FOIA officers review the emails to ensure 
ClassNet use is appropriate before transmitting to the State Bureaus for 
review. 


3. (U//FEVO) Applying appropriate FOIA exemptions to protect classified 
information. State Department FOIA personnel recommended five “B1” 
(Classified National Security Information) FOIA exemptions for proposed 
redactions in the first set of 296 emails to protect classified information. 
According to State FOIA personnel, during the State Department Legal 
Office’s review, four of the Bl exemptions were removed and changed to 
“B5” FOIA exemptions (Privileged Communications). Recommend State 
Department FOIA Office seek classification expertise from the 
interagency to act as a final arbiter if there is a question regarding 
potentially cteeted materials. ; 

4. (U//FES) It is unclear if the Department of Justice is reviewing the 
emails before FOIA release. Former-Secretary Clinton’s emails are the 
subject of numerous FOIA requests and multiple FOIA lawsuits. It may be 
prudent to integrate the Department of Justice into the FOIA process review 
to ensure the redactions can withstand potential legal challenges. If not 
already being done, recommend the State Department FOIA Office 
incorporate the Department of Justice into the FOIA process to ensure 
the legal sufficiency review of the FOIA exemptions and redactions. | 


Z 


THIS IS A DELIBERATIVE PROCESS DOCUMENT AND INTENDED SOLELY FOR OFFICIAL USE BY THE IC. IG. 
RECIPIENTS MAY NOT FURTHER DISSEMINATE WITHOUT THE EXPRESS PERMISSION OF IC IG PERSONNEL. 
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ALL FS HeCR ATION CONTAINED 


FOR MANAGEMENT HEREIN 1S UNCLASSIFIED 
UATE 11-08-2016 =i 227088734 FS 
WASHINGTON 
UNCLASSIFIED JUN 25 20% 


MEMORANDUM FOR THE INSPECTOR GENERAL 
FROM: M — Patrick F. Kennedy YAR 


SUBJECT: Potential Issues Identified by the Office of the Inspector General of the 
Intelligence Community Concerning the Department of State’s Process for the 
Review of Former Secretary Clinton’s Emails under the Freedom of Information 
Act (ESP-15-04) 


] am in receipt of the subject Memorandum (dated June 19, 2015) and its accompanying 
Memorandum and Attachment from the Inspector General of the Intelligence Community 
(ICIG). Responses to the four recommendations are contained in the attached. 


The Department of State’s FOIA processes are consistent with of those of other agencies. 


State’s FOJA personnel analyze responsive records for disclosure pursuant to the provisions of 
the FOIA and apply exemptions to the documents as appropriate. Department FOIA reviewers 
are trained in applying the exemptions, using guidance made available by the Department of 
Justice’s Office of Information Policy. The reviewers consult with subject matter experts in 
Department components and with FOIA attorneys in the Department’s Office of the Legal 


Adviser, as appropriate. In turn, the Department’s attorneys consult regularly with attorneys at 


DOJ’s Federal Programs Branch and attorneys at U.S. Attorney’s Offices on legal issues that 
arise in the context of the FOIA and FOIA litigation. Consistent with the long-standing practice 


of third-agency review within the Executive branch and DOJ Policy on Referrals, Consultations, 


and Coordination, the Department consults with other agencies with respect to the review and 
disclosure of records that contain information that is of interest to another agency. 


Taking the above in account, the Department finds the issues raised by the ICIG are 
either already addressed in current processes or are inconsistent with interagency practices. 
Further, the recommendations provided by the ICIG would add to the FOIA review process 


schedule and make it more difficult to meet the U.S. District Court order for rolling productions 
without meaningfully enhancing the review process. 


Attachment: 


As Stated. 


UNCLASSIFIED 


HRC-393 


CG 


Recommendation #1 


The process utilized by the State Department to identify other agency equities is one with 
parallels throughout the United States Government. ; 


Prior to undertaking the current effort, a senior level meeting was held with representatives of 
a number of agencies (including the CIA and ODNI); the process to be utilized was outlined; and 
no objection was entered. 


The retired senior Foreign Service Officers are utilized because of their years of both FOIA 
experience and substantive expertise in the various regional and functional issues that are 


reviewed. 


If there are specific examples from the “Benghazi” 296 set that are of concem, the 
Department would welcome further information. 


Recommendation #2 


The State Department Classified network is authorized to handle up to SECRET material, 
including NOFORN, and thus ClassNet is the appropriate system for the storage and distribution 
of these FOIA materials. 


Should the Department identify an e-mail that potentially contains material that could be 
classified at a higher level, that material would be pulled from the database and transmitted for 
review via an appropriate channel. 


Recommendation #3 


Final determinations of classification decisions are made by senior personnel within the 
Department’s FOIA office, assisted by subject matter experts in relevant bureaus and in the 
Office of the Legal Adviser, after referral of other agency equities have been made to the 
appropriate agencies and their comments received. These individuals have the experience and 
expertise necessary to carry out this responsibility correctly. 


Recommendation #4 


Emails with Department of Justice equities Gncluding those of its component entities) are 
forwarded to the relevant DOJ entities for review. Legal sufficiency review of the FOLA 
exemptions and redactions are conducted by attorneys from the Office of the Legal Adviser; they 
consult regularly with the Department of Justice’s Federal Programs Branch regarding FOIA 
issues and litigation, including litigation involving the former Secretary’s emails. This type of 

‘process is common throughout the interagency. 


UNCLASSIFIED 
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UNCLASSIFIED June 29, 2015 
MEMORANDUM FOR UNDER SECRETARY KENNEDY 


FROM: 4 Steve A. Linick, Inspector General, Department of State 
I. Charles McCullough, I, Inspector General, Intelligence Community 


SUBJECT: Potential Issues Identified by the Office of the Inspector General of the 
Intelligence Community Concerning the Department of State’s Process for the 
Review of Former Secretary Clinton's Emails under the Freedom of Information 
Act (ESP-15-05) 


We understand that, in compliance with a federal court order connected to pending Freedom of 
Information Act (FOIA) litigation, the Department plans to publish tomorrow a portion of the 
55,000 pages of emails produced by former Secretary Clinton. We are therefore providing this 
Memorandum as follow up to our June 19, 2015, Memorandum to you, to provide additional 
information supporting our concerns about the current process underway to review the 55,000 
pages of emails prior to publication. 


On June 26 and June 27, 2015, Department staff responsible for FOIA issues further reviewed a 
portion of the 55,000 pages that have been or are to be reviewed. They report discovering 
hundreds of potentially classified emails within the collection. In addition, there is concern that 
possible classified material will be posted in tomorrow's release. Staff members from the Office 
of Inspector General for the Intelligence Community (IC IG) are now taking steps to verify the 
classification of some of these emails. 


Under the circumstances, we continue to urge the Department to adopt the recommendations 
made by the IC IG in our June 19 Memorandum in order to enhance the current review system 
and to further minimize risk. The Department should ensure that no classified documents are 
publically released. 


Cc: D-MR - Heather A. Higginbottom 


ESP-15-05 U.S. Department of State, Office of Inspector General, Washington, DC 20522-0308 


HRC-395 
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| | ay b3 per ODNI 


b6 per ODNI 
From: Chuck Mccullough b7C per ODNI 


Sent: Monday, June 29, 2015 7:49 PM 
To: | 


Subject: [AIN] FW: Follow Up Memorandum 


b3 per ODNI 


I. Charles McCullough, III 


Intelligence Community Inspector General 


b6 per ODNI 
. b7C per ODNI 


From: Kennedy, Patrick F [mailto:KennedyPF@state.gov] 
Sent: Monday, June 29, 2015 7:15 PM 

To: Linick, Steve A (OIG) 

Ce: Higginbottom, Heather A; Chuck Mccullough 
Subject: RE: Follow Up Memorandum 


Steve : 


I would appreciate your advising the Ic IG that if his office believes that 
there is material that needs to be withheld, it needs to identify the specific 
documents involved. The ?Bates Stamp? number on the document is a sufficient 
reference item to let us know which are of concern. 


Since we are set by court order to publish the first tranche tomorrow, I 
would hope that we get this material soonest. 


HRC-396 


pat 


From: Linick, Steve A (OIG) 
Sent: Monday, June 29, 2015 7:11 PM ‘ 
To: Kennedy, Patrick F 


Cc: Higginbottom, Heather A; Chuck Mccullough [ Bees, CONt 
b6 per ODNI 


Subject: Follow Up Memorandum 
b7C per ODNI 
Dear Pat: 


Please see attached follow-up Memorandum regarding potential issues 
identified by the IC IG concerning the Department?s process for the review of 
former Secretary Clinton?s emails. Please feel free to contact Chuck 
McCullough with any questions. Best, Steve 


HRC-397 


ALL FRI INSCRMATION CONTAINED 
HEREIN 15 UNCLASSIFIED 
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: b3 per ODNI 
| b6 per FBI, ODNIL 
b7C per FBI, ODNI 
Sent: Thursday, July 02, 2015 12:37 PM 
To: | 


Ce: Kennedy, Patrick F; Linick, Steve A (OIG) 


OIG) 
Subject: [AIN] Follow Up from Yesterday's Meeting 


b3 per ODNI 


b6 


b5 per DOS 


HRC-398 


b5 per DOS 


Thanks. 


Cs ¥ 


b7C 
Office of Inspector General 


U.S. Department of State 


-68t- This email is UNCLASSIFIED. 
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UNCLASSIFIED s@=. - PRODUCED TO HOUSE SELECT BENGHA M. 
U,S. Department of State SUBJECT TO AG ENT ON SENSITIVE INFORMATION & REDACTIO O FOIA WAIVER. 
Case‘No. F22@15-04841 : : 


Doe No. C05739772 
Date: 05/13/2015 


symbol of their commitment to disarm the militias and anti-government groups, and. increased their 


involvement accordingly.) 
f 
UNCLASSIFIED 
U.S. Department of State 
Case No. F-2015-04841 
Doc No. C05739772 STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. HPC-400 
STATE-SCB0045762 


Date: 05/13/2015 SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 


a ALL EBL INZCRMATION CONTAINED 
e @o= 15 UNLLASS PF IeU 
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a4 BSllG 


b3 per ODNI 
b6 per FBI, ODNI, 


b7C per FBI, ODNI 


From: Kennedy, Patrick F <KennedyPF@state.gov> 
Thursday, July 02, 2015 8:12 PM 


To: 
Ce: Linick, Steve A (OIG) 
Subject: [AIN] RE: Follow Up from Yesterday's Meeting 


b3 per ODNI 


oe 


—_ : 
b7C 


So - 


Regards 


pat 


b3 per ODNI 

b6 per FBI, ODNI 
(OIG) b7C per FBI, ODNI 
02, 2015 12:37 PM 


‘Cc: Kenned Patrick F; Linick, Steve A (OIG); 


(OIG) 
Subject: Follow Up from Yesterday's Meeting 


HRC-401 


b7C 


b5 per DOS 


Thanks. 


b7c 
Office of Inspector General 


HRC-402 


U.S. Department of State 


b6 
b7C 


“sBt- 


This email is UNCLASSIFIED. 


HRC-403 


RESET 16 UNUDLASS FP IEL 
Le Jie De 2016 Bo gaieesTae Bello 


. b3 per ODNI 
b6 per FBI, ODNI 


, b7C per FBI, ODNI 


Sent: Monday, July 06, 2015 3:27 PM 


@ BLL gS. [NCR ATION CONTAINED 


To: Jennifer L Hudson; 
Ce: OIG)’; 
Subject: [AIN] RE: Request for assistance from IC FOIA Officials 


b3 per ODNI 


Thanks Jennifer. Please advise if you require any further information from us. 
L | 7 
b7c 


Please advise if you will begin to coordinate with Ms. Hudson, and other Ic 
FOIA officials, on the additional assistance to identify IC equities. Also, 
advise if you need any additional information from us. 


Cheers, 


b3 per ODNI 
b6 per ODNI 
b7C per ODNI 


Office of the Inspector General of the Intelligence Community 


HRC-404 


INSPECTOR GENERAL SENSITIVE INFORMATION 


This e-mail including any attachments is intended only for authorized 
recipients. Recipients may not further disseminate this information without 
the express permission of the sender or other Office of the Inspector General 
of the Intelligence Community personnel. This email may contain Inspector 
General sensitive information that is confidential, sensitive, work product or 
attorney-client privileged, or protected by Federal law, including protection 
from public disclosure under the Freedom of Information Act (FOIA), 5 USC § 
552. Accordingly, the use, dissemination, distribution, or reproduction of 
this information to or by unauthorized or unintended recipients may be 
unlawful. If you have received this e-mail in error, please notify us 
immediately by return email, and please destroy all copies of the e-mail 
received in error. 


b3 per ODNI 
b6 per FBI, ODNI 
From: Jennifer L Hudson b7C per FBI, ODNI 


Sent: Monda July 06, 2015 2:51 PM 


ject: RE: Request for assistance from IC FOIA Officials 


b3 per ODNI 
b6 per ODNI 
b7C per ODNI 


We are willing to provide assistance to State in recognizing IC equities. At 
this point I know NSA and NGA are willing to help, and I believe CIA may also 
be willing to participate. 


This would be to help State identify equities so that records could be 
referred through the normal process. I do not think that anyone intends: to 
send officers down to State on a full-time basis to review and redact. 


Jennifer 


Jennifer Hudson 
Director, Information Management Division 


ODNI/CIO b3 per ODNI 
b6 per ODNI 


HRC-405 


b3 per ODNI 
b6 per FBI, ODNI 


b7C per FBI, ODNI 
From: 


Sent: Monday, July 06, 2015 2:12 PM 


To: Jennifer L Hudson 


Subject: Request for assistance from IC FOIA Officials 
Greetings Jennifer, 


I hope that you are well. As discussed, the IC IG recommended that State 
FOIA officials seek the assistance of IC FOIA officials for identifying Ic 
equities in the current State FOIA review of over 30,000 emails provided by 
Former Secretary Clinton. As the ODNI FOIA official, we are seeking your 
assistance with this recommendation. Please advise if you are willing to 
provide such assistance to the State FOIA officials and if you are, can you 
reach out to other IC FOIA officials and ascertain if they too are willing to 
provide such assistance. We look forward to your response. 


Thanks in advance, 


b3 per ODNI 
b6 per ODNI 
b7C per ODNI 


Office of the Inspector General of the Intelligence Community 


INSPECTOR GENERAL SENSITIVE INFORMATION 


This e-mail including any attachments is intended only for authorized 
recipients. Recipients may not further disseminate this information without 
the express permission of the sender or other Office of the Inspector General 
of the Intelligence Community personnel. This email may contain Inspector 
General sensitive information that is confidential, sensitive, work product or 
attorney-client privileged, or protected by Federal law, including protection 
from public disclosure under the Freedom of Information Act (FOIA), 5 USC § 
552. Accordingly, the use, dissemination, distribution, or reproduction of 
this information to or by unauthorized or unintended recipients may be 
unlawful. If you have received this e-mail in error, please notify us 
immediately by return email, and please destroy all copies of the e-mail 
received in error. 


HRC-406 


HRC-407 


r ALL BI INECRATION COMTATHED 
HEREIN IS UNCLASSIFIED 
DATE 11-08-2016 BY Ja7de5T94 NS 


; b3 per ODNI 
| | b6 per FBI, ODNI 


b7C per FBI, ODNI 


From: es | 

Sent: 

To: 

ce: 1 
, Grafeld, Margaret P 

Subject: __ [AIN] RE: Request for assistance from IC FOIA Officials 


b3 per ODNI 


L_| This offer of assistance by the IC is something the IC OIGpwi ed 
to work out with the Under Secretary for Management Patrick Kennedy. 
b3 per ODNI 
b6 per FBI, ODNI 


b7C per FBI, ODNI 
Director : b7C 
Office of Information Programs and Services (IPS) 
Bureau of Administration 
Department of State 
SA-2, Room 5021 
Washington, DC 20520 


; b7C 


202-261-8590 (fax) 


b3 per ODNI 


Sent: Monday, July , : b7C per ODNI 


HRC-408 


on; 


Ject: RE: Request for assistance from IC FOIA Officials b3 per ODNI 
: b6 per FBI, ODNI 
b7C per FBI, ODNI 


Thanks Jennifer. Please advise if you require any further information from 
us. 


b6 


Please advise if you will begin to coordinate with Ms. Hudson, and other IC 
FOIA officials, on the additional assistance to identify IC equities. Also, 
advise if you need any additional information from us. 


\ 


.Cheers, 


b3 per ODNI 
b6 per ODNI 
b7C per ODNI 


Office of the Inspector General of the Intelligence Community 


INSPECTOR GENERAL SENSITIVE INFORMATION 


This e-mail including any attachments is intended only for authorized 
recipients. Recipients may not further disseminate this information without 
the express permission of the sender or other Office of the Inspector General 
of the Intelligence Community personnel. This email may contain Inspector 
General sensitive information that is confidential, sensitive, work product or 
attorney-client privileged, or protected by Federal law, including protection 
from public disclosure under the Freedom of Information Act (FOIA), 5 USC § 
552. Accordingly, the use, dissemination, distribution, or reproduction of 
this information to or by unauthorized or unintended recipients may be 
unlawful. If you have received this e-mail in error, please notify us 
immediately by return email, and please destroy all copies of the e-mail 
received in error. 


HRC-409 


b3 per ODNI 
b6 per FBI, ODNI 
b7C per FBI, ODNI 


core) [ 


Subject: RE: Request for assistance from IC FOIA Officials 


b3 per ODNI 
b7C per ODNI 


We are willing to provide assistance to State in recognizing IC equities. At 
this point I know NSA and NGA are willing to help, and I believe CIA may also 
be willing to participate. 


From: Jennifer L Hudson 


15 2:51 PM 


This would be to help State identify equities so that records could be 
‘referred through the normal process. I do not think that anyone intends to 
send officers down to State on a full-time basis to review and redact. 


Jennifer 


Jennifer Hudson 


Director, Information Management Division 


ODNI/CIO 
b3 per ODNI 


b7C per ODNI 


From: 
Sent: Monday, July 06, 2015 2:12 PM 
To: Jennifer L Hudson 


oe (he 


Subject: Request for assistance from IC FOIA Officials 
Greetings Jennifer, 


I hope that you are well. As discussed, the IC IG recommended that State 
FOIA officials seek the assistance of IC FOIA officials for identifying IC 
equities in the current State FOIA review of over 30,000 emails provided by 
Former Secretary Clinton. As the ODNI FOIA official, we are seeking your 
assistance with this recommendation. Please advise if you are willing to 


3 


HRC-410 


provide such assistance to the State FOIA officials and if you are, can you 
reach out to other IC FOIA officials and ascertain if they too are willing to 
provide such assistance. We’look forward to your response. 


Thanks in advance, 


b3 per ODNI 
b6 per ODNI 
b7C per ODNI 


Office of the Inspector General of the Intelligence Community 


INSPECTOR GENERAL SENSITIVE INFORMATION 


This e-mail including any attachments is intended only for authorized 
recipients. Recipients may not further disseminate this information without 
the express permission of the sender or other Office of the Inspector General 
of the Intelligence Community personnel. This email may contain Inspector 
General sensitive information that is confidential, sensitive, work product or 
attorney-client privileged, or protected by Federal law, including protection 
from public disclosure under the Freedom of Information Act (FOIA), 5 USC § 
552. Accordingly, the use, dissemination, distribution, or reproduction of 
this information to or by unauthorized or unintended recipients may be 
unlawful. If you have received this e-mail in error, please notify us 
immediately by return email, and please destroy all copies of the e-mail 
received in error. 


HRC-411 


Mn, 
ALL BI INZOGRMATION CONTAINED 
BEREIN [5 UND LASSI FIED 
DATE 11-06-2016 By Ja7uesTs4 Nsite 


| | b3 per ODNI 
b6 per FBI, ODNI 


b7C per FBI, ODNI 


From: Linick, Steve A (OIG) <linicksa@state.gov> 
Sent: Monday, July 06, 2015 6:40 PM 
To: Kennedy, Patrick F 
Ce: 

(OIG) 
Subject: [AIN] FW: Follow Up from Yesterday's Meeting 

b3 per ODNI 

Pat, 


Concerning Item #1, as reflected in the email immediately below from Jennifer 
Hudson that I have copied into this email, ODNI has been gathering IC resources 
to support the review. I urge you to contact Jennifer, directly, to 
facilitate ODNI?s offered assistance. 


Please contact me at your earliest convenience on the results, and whether 
you will be providing a memorandum supplementing your June 19, 2015 response. 


Steve 


b3 per ODNI 


] b7C per FBI, ODNI 


Subject: RE: Request for assistance from IC FOIA Officials 


1 


HRC-412 


b3 per ODNI 


b7C per ODNI 


We are willing to provide assistance to State in recognizing IC equities. At 
this point I know NSA and NGA are willing to help, and I believe CIA may also 
be willing to participate. 


This would be to help State identify equities so that records could be 
referred through the normal process. I do not think that anyone intends to 
send officers down to State on a full-time basis to review and redact. 


Jennifer 


Jennifer Hudson 
Director, Information Management Division 


ODNI/CIO 


b6 per ODNI 
b7C per ODNI 


SB 


This email is UNCLASSIFIED. 


From: Kennedy, Patrick F 
Sent: Thursda uly 02, 2015 8:12 PM 
To: (OIG) ; 
Ce: Linick, Steve A (OIG); 


b3 per ODNI 
b6 per FBI, ODNI 
b7C per FBI, ODNI 


Subject: RE: Follow Up from Yesterday's Meeting 


Ld] o 


b7C 


2 


HRC-413 


b5 per DOS 


Regards 


pat 


From: L________](o16) b3 per ODNI 


Sent: Thursda July 02, 2015 12:37 PM : b6 per FBI, ODNI 


TO b7C per FBI, ODNI 
Cc: Kenned Patrick F; Linick, Steve A (OIG); [ 


3 
Subject: Follow Up from Yesterday's Meeting 


b6 


b5 per DOS 


HRC-414 


b5 per DOS 


Thanks. 


[ 


Office of Inspector General , b6 


7 
U.S. Department of State PIS 


“SBU- 


This email is UNCLASSIFIED. 


HRC-415 


@ G2 EB HECERATION CONTAINED 
il 


is UNCLASS a 
DATE l1-U6-2016 Bi JS/ueo'o4 Nelle 


| | b3 per ODNI 


b6 per FBI, ODNI 


From: Kennedy, Patrick F <KennedyPF@state.gov> b7C per FBI, ODNI 
Sent: Tuesday, July 07, 2015 8:47 AM 
To: Linick, Steve A (OIG 


Cec: 


Subject: [AIN] Re: Follow Up from Yesterday's Meeting 


b3 per ODNI 


Steve 


Jennifer has reached out directly to the Department's FOIA officer to say she 
is in discussion with other IC elements. 


b5 per DOS 


Regards 
Pat 


From: Linick, Steve A (OIG) 

Sent: Tuesday, July 07, 2015 12:39 AM ; b3 per ODNI 

To: Kennedy, Patrick F b6 per FBI, ODNI 
Ce: Chuck _Mccullough b7C per FBI, ODNI 
OIG); : 


(OIG) ; 
Subject: FW: Follow Up from Yesterday's Meeting 


Pat, 


i 


Concerning Item #1, as reflected in the email immediately below from Jennifer 
Hudson that I have copied into this email, ODNI has been gathering IC resources 
to support the review. I urge you to contact Jennifer, directly, to 
facilitate ODNI’s offered assistance. ‘ 


1 


HRC-416 


Please contact me at your earliest convenience on the results, and whether 
you will be providing a memorandum supplementing your June 19, 2015 response. 


Steve 


b3 per ODNI 


] : b7C per FBI, ODNI 


Subject: RE: Request for assistance from IC FOIA Officials 


b3 per ODNI 


; b6 per ODNI 
[Ld BIC per ODNI 


.We are willing to provide assistance to State in recognizing IC equities. At 
this point I know NSA and NGA are willing to help, and I believe CIA may also 
be willing to participate. 


This would be to help State identify equities so that records could be 
referred through the normal process. I do not think that anyone intends to 
send officers down to State on a full-time basis to review and redact. 


Jennifer 


Jennifer Hudson 


Director, Information Management Division 


ODNI/CIO 
b3 per ODNI 


b7C per FBI, ODNI 


HRC-417 


-“3— 


Ps 


This email is UNCLASSIFIED. 


From: Kennedy, Patrick F 

Sent: Thursday, July 02, : b3 per ODNI 

To (OIG) ; b6 per FBI, ODNI 
Ce: Linick, Steve A (OIG); b7C per FBI, ODNI 


Subject: RE: Follow Up from Yesterday's Meeting | 


b6 


b5 per DOS 


Regards 
pat 
b3 per ODNI 


b6 per FBI, ODNI 
b7C per FBI, ODNI 


(OIG) 
02, 2015 12:37 PM 


Subject: Follow Up from Yesterday's Meeting 


b6 


b5 per DOS 


HRC-418 


b5 per DOS 


Thanks. 


a = 
b7C 
Office of Inspector General 


U.S. Department of State 


b6 
b7C 


HRC-419 


aS . % 


This email is UNCLASSIFIED. 
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UNCLASSIFIED July 10, 2015 
MEMORANDUM FOR UNDER SECRETARY KENNEDY 


FROM: Steve A. Linick, Inspector General, Department of State 
Charles McCullough, Ill, Inspector General, Intelligence Community 


SUBJECT: Request for Electronic Copy of Former Secretary Clinton's Emails 


As you know, the Office of the Inspector General (OIG) is currently reviewing the use of personal 
communications, hardware and software by five Secretaries of State and their immediate staffs, 
and is receiving assistance from the Office of the Inspector General of the Intelligence . 
Community (ICIG). 


' ah b6 
During our July 1, 2015, meeting with you and sit the Icigl___advised us Bae 


that the Department has obtained from Secretary Clinton's counsel an electronic copy of the 
55,000 pages of emails produced by Secretary Clinton in hard copy to the Department in 
December 4, 2014. As further background, on June 24, 2015, Secretary Clinton's counsel sent 
OIG a letter, which was shared with you the following day, advising that her counsel retained “a 
preservation copy of the .pst file containing the electronic copies of those e-mails, on a thumb 
drive that is stored in a secured safe” in counsel's offices. OIG now requests that you provide to 
OIG two copies of this .pst file, for use by OIG and ICIG. 


. b6 


cc: D-MR - Heather A. Higginbottom 


U.S. Department of State, Office of Inspector General, Washington, DC 20522-0308 


HRC-421 


United States Department of State 


ALL FRI INFORMATION CONTAINED ees i 
HEREIN 16 quciass a Under Secretary of State 


URTE 11-08-2016 BY JS7ge57TS4 HSICG for Management 


Washington, D.C. 20520 


UNCLASSIFIED 
MEMORANDUM July 22, 2015 


TO: OIG — Steve A. Linick 
FROM: M — Patrick F. Kennedy Pac 


SUBJECT: Your Request for Electronic Copy of Former Secretary Clinton’s 
Emails 


This memorandum is in response to your July 10, 2015, memorandum in 
which you ask that the Department provide to OIG and to the Inspector General for 
the Intelligence Community (IC1G) .pst files containing all of the emails that 
Secretary Clinton produced to the Department in hard copy in December 2014. 


First, to clarify[ ___|told___—_—ihat the Department has requested 6 
Secretary Clinton’s counsel to provide an electronic copy of the emails that were 
produced. [_Jalso advised that, while Secretary Clinton’s counsel agreed to 
do so, we had not yet received — nor have we since received — such a copy. 


As you know, the Bureau of Administration (A) has, scanned and loaded the 
emails in a .pdf file into a system on CLASSNET for record keeping purposes and 
the ongoing Freedom of Information Act (FOIA) review of this material, as well as 

’ to fulfill other FOIA requests. 


In the course of the current review, your staff has been given access to those 
electronic records on CLASSNET, including the ability to conduct searches on 
particular segments. This electronic access can be extended to the entire body of 
material via CLASSNET if you wish. 


Given the intense public interest in and the sensitivity of the former 
Secretary’s emails, we would have serious concerns about providing the emails 
outside of the Department in a removable/transferable medium. Moreover, we have 
concerns about providing any such removable copy to the ICIG for the simple 
reason that much of what is contained in Secretary Clinton’s emails relate to the 
programs and operations of the Department of State and not to programs and 


UNCLASSIFIED 
HRC-422 


ty 


e 8 
~ UNCLASSIFIED 
2 


operations over which the ICIG has oversight responsibilities. See Inspector 


- General Act §2; et seq. For example, there are numerous emails relating to 


deliberations and decisions regarding the appointment of individuals to positions at 


- the Department of State. It seems beyond the scope of the ICIG’s authority to 


review such emails and could be an unnecessary invasion of the privacy of the 
individuals being considered. Similarly, the emails include information, much of it 
deliberative, concerning a broad range of Department programs and operations that 
cannot reasonably be said to implicate IC equities. 


At the invitation of the A Bureau, IC FOIA reviewers are reviewing emails 
and identifying those emails that might implicate IC equities. Copies of any such 
emails are then being provided to the IC for its review. The ICIG can obtain those 


emails from the IC entities for which it has oversight responsibility, or, if you wish, 
we can identify those emails to your office so that you can work with the ICIG. 


cc: The Deputy Secretary for Management and Resources 


UNCLASSIFIED 
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ALL EBL LNZURMATION (ONT AINE 
HERETH [6 UNLLASS FP IEL 


Le 1O-el-2016 Be GaiessTae BSlle 


United States Department of State 
Washington, D.C. 20520 


“SENSTTIVE BUF UNCLASSIFIED 
(NOT SENSITIVE WHEN SEPARATED FROM ATTACHMENT) 


Case No. F-2015-04841 b6 per FBI, DOS 
Segment: = b7C per FBI 
Requester | . 
TO: eT || be 
Record/Information Dissemination Section b7C 
Records Management Division 
Federal Bureau of Investigation 
Washington, DC 20535 . 
se 


Office of Information Programs and Services 


be 
b7c 


FROM: 


SUBJECT: FOIA Referral for Consultation 


The attached Department of State material requested in the above FOIA 
case appears also to be of interest to your agency, and we are therefore 
referring it to you for consultation. In view of the strong public interest in 
this matter, we would appreciate your reply no later than close of business on 
Tuesday, April 7, 2015. 


The documents consist of emails sent to and/or from former Secretary 


of State Clinton on her private email account. For your information, these 
é 


emails have already been provided to Congress in redacted form; the 

Reece se aa ene be 
Department of Justice on that effort. We have duplicated those redactions, 

and have made some additional redactions under the FOIA which we believe ~ 

are warranted for wider distribution. 


Please be advised that it is our intention to post all released material on 
the State Department’s FOIA website. 


“SENSTTFVE BETUNCLASSIFIED 
. (NOT SENSITIVE WHEN SEPARATED FROM ATTACHMENT) 


HRC-457 
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| UNCLASSIFIED 
(NOT SENSITIVE WHEN SEPARATED FROM ATTACHMENT) 
; -2- | 


Our preliminary determinations are noted on each document. Portions 
for withholding (if any) are as indicated, and the exemptions are noted in the 
margin. Where we have requested concurrent review by other agencies, the 
names of those agencies are also shown on each document. 


_ Before we take final action, we ask that you review this material. We 
ask that you not mark for deletion any portion of any document on non® 
responsive grounds. 


Please address your reply t 


They can also be reached at b7c 


Should you receive any inquiries about this collection, please refer 
them directly to us for response. Additionally, do not hesitate to contact us 
with any questions. 


Attachments: 
One document 
Copy of request letter 


—SENGERFVE-BUFUNCLASSIFIED 
(NOT SENSITIVE WHEN SEPARATED FROM ATTACHMENT) 
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ALL el [PORATION CONTAINED 


HESEIN 15 URUCLASSIET 
DATE ll-Ol-20l6 BY gs70eb154 Nalce 


Brothers, Karen G F- LO IS a 0 U8 q4 
arene rere eee a a, 
Sent: ‘ Tuesday, March 03, 2015 1:50 PM 

To: - FOIA Request 

Subject: Freedom of information Request: Hillary Clinton’s Email Address 

March 3, 2015 

Department of State 

Office of Information Programs and Services 

A/GISAPS/RL 


U. S. Department of State 
Washington, D. C. 20522-8100 


To Whom It May Concern: 
This is a request under the Freedom of Information Act. I hereby request the following records: 


Former Secretary Hillary Clinton's email address used to email State Department officials. Referenced here: 
http://redirect. state, sbu/?url=http://www. wila.com/articles/2015/03/hillary-clinton-s-personal-email-use-may- 


have-violated-federal-requirements-report-111962.html 


"After the State Department reviewed those emails, last month the State Department produced about 300 emails 
responsive to recent requests from the Select Committee." 


The requested documents will be made available to the general public free of charge as part of the public 
information service at MuckRock.com, and is not being made for commercial usage. 


In the event that fees cannot be waived, I would be grateful if you would inform me of the total charges in 
advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if 
available or CD-ROM if not. 


‘Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response 
to this request within 20 business days, as the statute requires. 


Sincerely, 


Filed via MuckRock.com 


pemil Greed) 


For mailed responses, please address (see note): 


b6 per DOS 
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CO5739808 sv rcr ro SEArERERT MGR ASAE BR EEL SBERRNED crn waver 


CONSULT FBI RELEASE IN FUL 
From: Sullivan, Jacob J <SullivaniJ@state.gov> 
Sent: Sunday, November 18, 2012 8:44 PM 
To: H 
Subject: Fw: FYI - Report of arrests -- possible Benghazi connection 
Fyi 
From: Jones, Beth E ; 
Sent: Sunday, November 18, 2012 07:14 PM 
T ivan, Jacob 5 b6 


Ce b7C 
Subject: Fw: FYI - Report of arrests — possible Benghazi connection 


This preliminary, but very interesting, pls see below. FBI in Tripoli is fuliy involved. 


From____ : b6 
Sent: Sunday, November 18, 2012 07:01 : b7Cc 
To: Jones, Beth E; Maxwel, Raymond D; ie ol 

Subject: FYI - Report of arrests -- possible Beng con n 


HAVE Vine CONE 


Post reports that Libyans police have arrested several people today who ma 


the Benghaz! attack. They were acting on Information furnished by DS/RSO. bl per DOS, FBI 


b3 per FBI 
b7A per DOS 
b7D per DOS 
b7E per DOS 


this could lead to something operationally, or not, and it could lead to news accounts from Libya saying there 
is a significant break in the case, or not. : 


At this point, just FYI. 
a b6é 
b7C 
Department of State 22 HED. 
CLASSIFIED BY SSIcG 387555754 


: REASON: 1 4 (0) 
DEC LASSI2¥ ON: 12-31-2037 
ATE: Lil 0? 2016 


STATE DEPT. - PRODUCED TO E,SELECT BENG MM. 
SUBJECT TO AGREEMENT OINENS LARSSON A BION GUARD no FOIA WAIVER. STATE-SCB0045788 


-ARC-460 


e =r e 


SUBJECT TO AGREEMENT ON SENSINGENRFORMATION SG REDACTIONS’ NO FOIA WAIVER. 


CONSULT FBI RELEASE IN FUL 

From: Sullivan, Jacob J <SullivardJ@state.gov> eel Deo 
Sent: - Sunday, November 18, 2012 8:44 PM ELASSIZIED BY HSC J275e57c4 
To: H REASCH 1 4 (Ci 

ur os : : , ECLASSIFY CH- 12-21-2087 
Subject: Fw: FYI - Report of arrests -- possible Benghazi connection ae tk a ae 
Fyi 
From: Jones, Beth E é b6é 
Sent: Su H b7c 


Sullivan, Jacob J 


afrests — possible Benghazi connection 
bl per DOS, FBI 


This preliminary, but very interesting, pis see below. FB! in Tripoli is fully invotved. : b3 per FBI 
ae ee. . Bestacues ito ad bas 6 per FBI 
Frot , b7C per FBI 


Sent: Sunday, November 18, 2012 07:0 b7A per DOS 
To: Jones, Beth E; Maxwell, Raymond b7D per DOS 
Subject: FYI - Report of arrests -- possible Benghazi con b7E per DOS 


Something Op 
ae a SnnHGnt break i in the case, or not. 


At this point, just FYI. 


-b6 
b7C 


Department of State ‘ 


—_ 


STATE NEOT . COMMUCEN TA WICE Cel ECT REAIRMAT Oona 
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Classification: SECRET+ANGEORN 11) 


Classified By: J23J98T32 
Derived From: 
Declassi 20401231 


TRANSITORY RECORD 


ated 20120629 


FYI. 


b6 
b7C¢ 


Subject: Coordination Review - zener H-3 ---SEEREF/NOFORN- 
Importance: High 


Classification: oe 


dated 20120629 


n: 20401231 


TRANSITORY RECORD 


: b6 
Here is our response. | recommend you go ahead and classify the forwarding email to us in the future in case we 
determine there is classified information. This marking was approved by the CTD front office. The first bracket starts 
the second bracket starts with[ "J, the third bracket] The b1 marking 
bl per DOS, FBI 


b3 per FBI 
705739808 - Work 
- CTD Redacti... 
b6 
b7C 
Classification: SpexkT / /NOFORN 
2 


HRC-469 


in 


Classification: SECREE+A#OFORN 


HRC-470 


b6 
b7Cc 


a 
_HRC-488° 
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: y ™N 
ALL FHI INFORMATION CONTAINED 
HEREIN [5 UNCLASSIE TE! 


Be 10-21-2016 Be gs7ce5T9s HsicG 


U.S. Department of Homeland Security 
UNITED STATES SECRET SERVICE 


Washington, D.C. 20223 


August 6, 2015 


Charles H. Kable IV 

Section Chief 
Counterintelligence Division 
Federal Bureau of Investigation 
Washington, DC 20535-0001 


Re: Request for Preservation of Records dated July 31, 2015 
Dear Mr. Kable: 


Reference is made to your formal request for the preservation of all records and other 
evidence in the possession of the United States Secret Service (“Secret Service”). or in the 
possession of Hillary Clinton, former Secretary of State, regarding the domain account 
@clintonemail.com. 


Your record preservation request seeks items from an individual referred to as “your 
client.” To the extent the word “client” refers to the Secret Service’s protectee, Hillary Clinton, 
the Secret Service could not lawfully take any item in the possession of a protectee absent a 
warrant for that item. Additionally, we are not aware that we are otherwise in possession of any 
such items. 


With respect to items or records in the possession of the Secret Service, we have 
previously searched and are in the process of conducting an additional search for Agency records 
responsive to a Freedom of Information Act (FOIA) request that is similar in nature to your 
request for records preservation. That FOIA request is now the subject of litigation in the United 
States District Court for the District of Columbia, Judicial Watch v. United States Secret Service, 
Civil Action No. 1:15-cv-00673-JDB. In that case, Plaintiff Judicial Watch filed a FOIA request 
. for “[a]ny and all records of communication between the United States Secret Service and 
Hillary Rodham Clinton concerning, regarding, or relating to creation, setup, security, and 
maintenance of the clintonemail.com email server.” 


The Secret Service performed the following search for responsive documents in the 
relevant directorates. The Office of Technical Development and Mission Support, Information 
Resources Management Division (IRMD) responded as follows: “IRMD does not create, setup, 
monitor, or maintain non-government email servers.” Accordingly, there was no search that 
would be reasonably calculated to locate responsive records. 


' The Office of Protective Operations conducted a search where the Assistant Director, the 
Deputy Assistant Director, and the Supervisory Staff Specialist searched desktop files and the 
office shared drive for any responsive documents. This search included official e-mail as well as 
their individual e-mail. Further, the Deputy Special Agent in Charge (DSAIC) of the Clinton 
Division searched his desktop and the office shared drive with the search terms “email server” 
and “Clinton server.” This search included official e-mail as well as his individual e-mail using 


HRC-489 


~ 


the search terms “email server” and “Clinton server.” The DSAIC also searched the file cabinets 
and drawers of the Clinton Division (the paper files) for any responsive documents. 


These searches did not reveal any responsive documents. The Department of Justice 
attorney handling the litigation, Andrew Carmichael, then spoke to Plaintiff's representative 
regarding what other searches Plaintiff would like the Secret Service to perform in an effort to 
resolve the litigation. After discussion, it was agreed that the Secret Service would perform an 
additional search. This search is for e-mails from anyone assigned to the Clinton detail from 
January 1, 2009, through and including January 31, 2009 that contain any of the following terms: 
email server, clinton server, and/or clintonemail.com. This search is being conducted and is 
expected to be completed in approximately two weeks. 


The Secret Service is not authorized, nor does it receive appropriations, to establish 
personal e-mail servers for anyone, including protectees. Notwithstanding, the Secret Service 
will send out a preservation request for the Agency records listed in your correspondence of 
July 31, 2015 which are in the possession of the Secret Service. As your request does not 
include a time frame, we have adopted a January 1, 2009 timeframe to the present as the relevant 
timeframe for preservation. 


Sincerely, 


jes 


“Donna L. Cahill 
Chief Counsel 


HRC-490 


b6 
b7C - 
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HEREIN [5 UNCLASS PIE 
a J0-el- 2016 By gaiassl96e Hello 


Bul Gel [NPORMETIOCN CONTAINED 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


David E. Kendall, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 


Washington, DC 20005 

b6 

. b7Cc 
Minor & Brown PC 
650 South Cherry Street, Plaza Il 
Suite 1100 
Denver, CO 80246 
August 7, 2015 
b6 


Dear Mr. Kendall and Ms[ | b7c 


This letter confirms your intent to voluntarily produce to the Federal Bureau of Investigation (“FBI”) a 
server and related equipment (collectively, “the server equipment”) on which emails to or from Secretary 
Clinton’s @clintonemail. com account were stored from 2009 to 2013 and which Platte River Networks 
took possession of in 2013. As it gathers more facts, the FBI reserves the right to request further 
information and/or equipment from Platte River Networks. 


On July 30, 2015, the FBI delivered to Platte River Networks a letter requesting that it preserve records 
related to the @clintonemail.com account. We understand that Platte River Networks, through Williams 
& Connolly LLP, also received other requests to preserve records related to the @clintonemail.com 
account, including a July 29, 2015 preservation letter from Senator Ron Johnson, Chairman, United States 
Senate Committee on Homeland Security and Governmental Affairs; a May 26, 2015 preservation letter 
from Steve A. Linick, Inspector General, Department of State and I. Charles McCullough, III, Inspector 
General, Intelligence Community; and a March 3, 2015 preservation letter from Representative Trey 
Gowdy, Chairman, House of Representatives Select Committee on Benghazi. 


Once taking custody, the FBI will maintain the server equipment in an appropriately secure manner, We 
believe such maintenance satisfies any preservation obligations you may have. 


b6é 
b7C 


HRC-492 ~ 


ee. 


David E. Kendall, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


Minor & Brown PC 

650 South Cherry Street, Plaza IT 
Suite 1100 

Denver, CO 80246 


Dear Mr. Kendall and ms|__| 


SLL 2S. HECEMATIOCN CONTAINED 
HEREIN IS UN LASS a 


GATE 10-31-2016 Br ga /venl3g4 Ns 


iG 


_ US. Department of Justice 


National Security Division 


Washington, D.C. 20530 


b6e 
b7C 


August 7, 2015 


b6 
b7Cc 


This letter confirms your intent to voluntarily produce to the Federal Bureau of Investigation (“FBI”) a 
server and related equipment (collectively, “the server equipment”) on which emails to or from Secretary 
Clinton’s @clintonemail.com account were stored. It is our understanding that the server equipment 

- constitutes the entirety of Platte River Network’s possession of equipment related to the 
@clintonemail.com account. If this understanding is incorrect, or if you learn of additional equipment 
related to the @clintonemail.com account, please notify me promptly. 


On July 30, 2015, the FBI delivered to Platte River Networks a letter requesting that it preserve records 
related to the @clintonemail.com account. We understand that Platte River Networks, through Williams 
& Connolly LLP, also received other requests to preserve records related to the @clintonemail.com 
account, including a July 29, 2015 preservation letter from Senator Ron Johnson, Chairman, United States 
Senate Committee on Homeland Security and Governmental Affairs; a May 26, 2015 preservation letter 
from Steve A. Linick, Inspector General, Department of State and I. Charles McCullough, III, Inspector 
General, Intelligence Community; and a March 3, 2015 preservation letter from Representative Trey 
Gowdy, Chairman, House of Representatives Select Committee on Benghazi. 


Once taking custody, the FBI will maintain the server equipment in an appropriately secure manner. We 
believe such maintenance satisfies any preservation obligations you may have. 


b6 
b7c 
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( b6é 
b7C 
(ee e | | 
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HESE IN IS UN LLASS u 
DATE 10-31-2016 Bi Gai J857s4 NSIC. 


@ ALL Fel [NSCRV ATION CONT AIUED 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


David E. Kendall, Esq.. 


- Katherine M. Turner, Esq. 


Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


August 6, 2015 


Dear Mr. Kendall and Ms. Turner, 


This letter confirms your intent to voluntarily produce to the Federal Bureau of Investigation (“FBI”) 
three thumb drives (which you have represented to be one original and two copies thereof) each 


- purportedly containing 30,490 emails to or from Secretary Clinton’s @clintonemail.com account that you 


previously provided in hard copy to the Department of State in December 2014, as well as hard copies 
and a laptop computer in your possession containing emails to or from the @clintonemail.com account. It 
is our understanding that the items described above (hereinafter “the Materials”) constitute the entirety of 
your Client’s and your possession of emails to or from the @clintonemail.com account, aside from six 
additional laptop computers we previously discussed by phone. It is also our understanding that those six 
laptop computers contain emails to or from the @clintonemail.com account; however, in addition to the 
emails, the laptop computers also contain privileged material. As such, we will work with you to 
appropriately secure the emails contained on those laptop computers. If any of these understandings are 
incorrect, or if you find any additional emails to or from the @clintonemail.com account, please notify 
me promptly. 


On July 31, 2015, the FBI delivered to Williams & Connolly a letter requesting that you preserve records 
related to the @clintonemail.com account. We understand that you have also received other requests to 
preserve records related to the @clintonemail.com account, including a July 29, 2015 preservation letter 
from Senator Ron Johnson, Chairman, United States Senate Committee on Homeland Security and 
Governmental Affairs; a May 26, 2015 preservation letter from Steve A. Linick, Inspector General, 
Department of State and I. Charles McCullough, III, Inspector General, Intelligence Community; and a 
March 3, 2015 preservation letter from Representative Trey Gowdy, Chairman, House of Representatives 
Select Committee on Benghazi. You have also represented that you will require continued access to the 
Materials on behalf of your client. 


Once taking custody, the FBI will maintain the Materials in an appropriately secure manner. We believe 
such maintenance satisfies any preservation obligations you may have. We will facilitate your continued 
access to the Materials as may be necessary and appropriate in a secure space at the Litigation Security 
Group, Department of Justice, at 145 N Street NE, Washington, DC 20002. 


Sincerely, 
b6é 


b7Cc 
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ALL #20 [N2O0RATION UONTAINED 


HESEIN [8 UNCLUASS IE IED , 
201) BY galoeaiTse BSG 


Dale 10-06- 


+“ FD-1057 (Rev. 05-08-2010) 


SECREH/NOFEORN- 


FEDERAL BUREAU OF INVESTIGATION 


(Difitle: (S44QF) MIDYEAR EXAM; Date: 08/04/2015 


(0) 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


From: Counterintelligence Division 

Counterespionage Section 

Contacts ASC] 
Approved By: Kable Charles H. ola 


Case ID #:(U.______——=«i ew 33 


Synopsis: (S4NE¥Meeting with Intelligence Community Inspector General (ICIG), Charles 
McCullough III on July 10, 2015. 


Enclosure(s): (U) Section 811(c) referral dated July 6, 2015, various correspondence between 
ICIG and Congressional committees, samples of e-mails, and original meeting notes. 


') On July 10, 2015 SC CharlesH.KableIV,ASC[_———S—S—S—=SdNLLSSBB 


and ASC met with ICIG Charles McCullough III and 
egarding their Section 811(c) referral, dated July 6, 2015. 


General Counsel 


{t}-- (SPRELThe ICIG was asked by Congress to assess the FOIA process the Department of 
State (DOS) was using to review Hillary Clinton’s e-mails for classified information before the 
e-mails were publicly disseminated. As part of this review, the ICIG’s office reviewed 296 
e-mails released under FIOA by DOS. Two of these e-mails were assessed by the USIC to contain 
classified information. McCullough assigne expert in 
classification review, to this project. 


of approximately 30,000 e-mails that were handed over to DOS by Hillary Clinton and found four 
additional classified e-mails. The ultimate classification determinations for these e-mails were 
conducted by the USIC. On July 9, 2015 McCullough formally requested, jointly with the DOS 
IG Steve Linick, copies of these approximately 30,000 e-mails from DOS Under Secretary of 
Management, Patrick Kennedy. The law office of Williams & Connolly, Clinton’s attorneys, 
currently have possession of the .PST files stored on thumb drives created from her original e-mail 
server. This server was managed by Platte River Networks and is being held in an unknown 
location. 


“SECRETHNOFORN 


be 
b7Cc 


b3 
b7E 


be 
b7Cc 


b3 per ODNI 


_ b6 per ODNI 


b7C per ODNI 
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To: Counterintelli ivision From: Counterespionage Section b3 
Re: (U) b7E 


1) egy FY. McCullough provided copies of correspondence between his office and DOS IG 
Linick, copies of the e-mails containing classified information and related research, as well as 
correspondence between ICIG McCullough and members of Congress involved in the oversight of 
the ICIG. 


o¢ 


SECRETHNOFORN 
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b6 
b7C 
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é ¢.. INZORMATION CONTAINED 


UNCLASSIFIED/ /FOue HEREIN IS UNCLASSIFIED 


DBTE ll-U7-2016 BY esa /Ce5T34 Uo 


U. S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to Washington, DC 20535 
File No. August 13, 2015 


I. Charles McCullough III 

Office of the Inspector General of the Intelligence Community 
12290 Sunrise Valley Drive 

Reston, 3, 2nd Floor 

Washington, DC 20505 


Dear Mr. McCullough: 


Please find enclosed copies of electronic media voluntarily 
“produced to the Federal Bureau of Investigation on August 6, 
2015 by Kathleen M. Turner, Esquire of Williams & Connolly, LLP. 
The FBI understands that these materials may be relevant to the 
inquiry your office is conducting pursuant to your statutory 
authorities under the National Security Act, as amended (50 
U.S.C. 3033), regarding allegations that classified information 
may reside on unclassified, non-government networks and/or may 
have been transmitted via personal email accounts. 


Based upon preliminary information available to the FBI, 
this material should be handled in accordance with all policies 
and procedures governing the handling and storage of material 
classified at the Top Secret//SCI level. Additionally, this 
material, including any associated metadata, is being provided 
for the sole use of your office for purposes of the inquiry 
identified above. Please do not copy or distribute the media 
produced or its content to anyone outside of your office, or 
make other disclosures about the media, without first obtaining 

. Page 1 of 2 
This document contains neither recommendations nor conclusions of the FBI. It is the 
property of the FBI and is loaned to your agency; it and its contents are not to be 


distributed outside your agency. 


UNCLASSIFIED/ /Feue 


HRC-515 © 


es 


_ UNCLASSIFIED/ /PeEUO. 


the written authorization of the Assistant Director, 
‘Counterintelligence Division, of the FBI, except as required to 
conduct your inquiry, Such as by referring specific documents to 
Executive Branch agencies for purposes of obtaining a 
classification review. : 


In the event you have any questions regarding the 
appropriate handling of this media or the use your office can 
make of it, please do not hesitate to contact me at 


= 


b6 
b7C 


Sincerely, 


or eC ware ey 
Randall C. Coleman 


Assistant Director, Counterintelligence Division | 
Federal Bureau of Investigation 


Page 2 of 2 
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aa ALL ZBI INECRVATION GOT aAln 
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C05739708 STATE DEPT. - PRODUCED TO HOUSE SELECT SENGHAZI COMM, 
: SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER, 


RELEASE IN 
FULL 


From: H shrod17@clintoneriail com> 

Sent nday, ir 16, 2042 12:48 PM 

To: b6 

Subject: Re: Visas Obtained bic 

As planned... 

—— Original Message -—- . 

Feom: Mills, Cheryl D [mailt b6 
b7C 


Sent: Sunday, September 16, 2012 12:45 PM 
To: H 
‘Subject; FW: Visas Obtained 


~~—Original Message-— 
From: Jones, Beth E 
Sent: Sunday, September 16,'2012:12;46 PM 


To: Kennedy, Patrick F: Mills, Cheryl of __=éiBulivany, Jacob | b6 
{ b7C 


Subject: FW: Visas Obtained 


FBI got thelr-visas for bya today: Five members of team and :three crew- HeMpers: Legatt was counted separately and 
already has-visa. The FBI team is Enroute tonight, ami told. 


STATE DEPT. - PRODUCED TO HOUSE SELECT 8ENGHAZI COMM. 
Riis TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS, NO FOIA WAIVER, STATE-SC80045379 
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~ @ @:. FRI INFORMATION CONTAIN 
HEREIN IS UNCLASSIFIED 


UATE ll-O)- 2016 Bl galgsels4 NSIlG 


C 0 5 7 3 9] 5 8 STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZ! COMM. 
rs ‘ SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 


RELEASE IN PART 
1B7(C). B7(A 


'b6 per FBI 
From: Mills Cheyid b7A per DOS 
Sent: Thursday, October 18, 2012 8:06 AM b7C per DOS, FBI 
To: H 
subjece ON ___..224 ed 
—=" B7(A) 
B7(C) 
Remind me to discuss. 
oe — . ' bIJA per DOS 
t: Thursday, October 18,2012 7:47 AM : 
sand : C b7C per DOS, FBI 


To: Sullivan, Jacob J; Mills, Cheryi D; Macmanus, Joseph E (S) 


een 


b6 per FBI 
b7A per DOS 
b7C per DOS, FBI 


Colleagues, 


Readout 
b7A per DOS 


b7C per DOS 


STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 
SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. STATE-SCB0045741 


a a ee 
HRC-321 


BETH IS UNCLASS u 
STE ll-O7-2016 Bi gelvenlgs No 


an e SLL 2S. HECEMATIOCN CUNTAINED 


Cc 0 5 7 3 9 7 5 8 STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 
Zz " SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 


b7A per DOS 
b7C per DOS 


— 


b6 
b7c 


Tunisia Desk 
Office.of Maghreb Affairs 


US. =a rtment of State 
Tel. b6 per FBI 


b7A per DOS 


From 
rs b7C per DOS, FBI 


b7A per DOS 
b7C per DOS 


b6 per FBI 
b7A per DOS 
b7C per DOS, FBI 


b7A per DOS 
b7C per DOS 


8 . 
Office of Maghreb Affairs b7c 
U.S. De ent of State 


Tel, 


STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZ! COMM. 
SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. STATE-SCB0045742 
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C05739635 STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 
SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER, 
Ib5 per DOS 
| 
| 
STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZ!t COMM. 


SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. STATE-SC80045S61 
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“ C05739635 STATE DEPT. - PRODUCED TO HOUSE SELECT SENGHAZI COMM. 
SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 


b5 per DOS 


STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZ! COMM. 
SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. : STATE-SCB0045562 


sts 
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RICHARD BURR, NORTH CAROLINA, CHAIRMAN ALL Fe HECRZAT ION CONTALUED 


DIANNE FEINSTEIN, CALIFORNIA, VICE CHAIRMAN ; - . 

JAMES E. RISCH, IDAHO RON WYDEN, OREGON ‘SECRETHNOFORN. es 1S = a 

N, s 

DANIEL COATS, INDIANA BARBARA A. MIKULSKI, MARYLAND DATE LL-O’-2s016 By ealvsolos4 WSillG 
MARCO RUBIO, FLORIOA MARK WAANER, 1A 


GIN ; 
SUSAN COLLINS, MAINE MARTIN HEINRICH, NEW MEXICO - 
ROY BLUNT, MISSOURI ANGUS 8. KING, Ja, MAINE met tates enate 
JAMES LANKFORD, OKLAHOMA MAZIEK. HIRONO, HAWall 


TOM COTTON, ARKANSAS 


SELECT COMMITTEE ON INTELLIGENCE 
MITCH MCCONNELL, KENTUCKY, EX OFFICIO 
HARRY REID. NEVADA. EX OFFICIO. WASHINGTON, DC 20810-6475 
wack REED, MODE ISLAND. EX OFFICIO 


CHRISTOPHER A. JOYNER, STAFF O(RECTOR 
DAVIO GRANNIS. MINORITY STAFF DIRECTOR 


DESIREE THOMPSON SAYLE, CHIEF CLERK J uly 27, 20 1 5 


The Honorable James R. Clapper, Jr. 
Director of National Intelligence 
Washington, DC 20511 


Dear Director Clapper: 


(t SANF) The Committee received the 25 July 2015 Memorandum from Mr. 
Charles McCullough entitled “Summary of IC IG support to State Department IG” 
and are troubled by the finding that “an inadvertent release of classified national 
security information had already occurred in the State FOIA process as a result of 
insufficient coordination with Intelligence Community (IC) elements.” 
Furthermore, we are concerned by the apparent disparity in assessments by State 
Department and the IC highlighted by the following statement, “State personnel 
continue to deny the classified character of the released information despite a 
definitive determination from the IC Interagency FOIA process.” While we agree 
with the four (4) recommendations the Intelligence Community Inspector General 
(ICIG) and State Department IG made to State to improve its FOIA review process 
to better identify IC equities and to prevent further inadvertent releases of 
classified information, we urge you to engage with Secretary Kerry and Inspector 
General Steve Linick to ensure their implementation. 


i} (SHNF) The Committee strongly disagrees, however, with State’s decision 
to provide its Own Inspector General with only “limited access” to the remaining 
30,000 emails and its decision to reject the ICIG’s request for access to the emails 
on “jurisdictional grounds.” We understand that a small sampling of just over 300 
emails found that four (4) contained information classified at the time of sending at 
the SECRET//NOFORN level and one (1) contained information classified at the 
time of sending at the SECRET//SI//REL USA,FVEY level.. Ultimately, you are 
responsible for the enforcement of classification guidelines and protection of IC 
equities and we urge you to take all necessary steps to identify and protect any 


‘SECRET#NOFORN- 


HRC-537 


additional sensitive information that may be contained within the remaining 
emails. ; 


(U) We appreciate your prompt attention to this matter. 


Sincerely, 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE - Date: 08/04/2015 
To: CD-4, Counterespionage Section Attn: 


From: CD-4 . 


b6 
Contact: SA b7c 
Approved By: Kable Charles H. IV 
\\s 
Drafted By: 
b3 
Case ID #: _ (U) b7E 


Title: 


F) MIDYEAR EXAM 


Synopsis: (U) Document August 3, 2015 Meeting at FBIHQ 


Classi 
Derived From: NSIC dated 20130301 


Declas On: 2040 


Details: (U//Feve} On August 3, 2015, FBI representatives met 
with representatives from the U.S. Department of Justice (DOJ), 
U.S. Department of State Office of the Inspector General (STATE 
IG) and Office of the Inspector General of the Intelligence 
Community (ICIG). The meeting took place at FBI Headquarters, 
935 Pennsylvania Ave, NW, Washington, DC 20535. 

i 
i) TSAAIEF) At this meeting, participants discussed the 
811(c) referral made to the FBI on July 6, 2015, regarding the 
potential compromise of classified information and STATE IG and 
ICIG’s ongoing review of State employees’ use of personal email 
and non-government networks for official purposes. Each IG 
provided a short summary of their respective reviews, limits of 
their authority, lack of resources and need for FBI/DOJ 
assistance. 


common practice at the Department of State for officials to send 
sensitive information on unclassified systems and later have 


BSECRET/ ANOFORN 
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(Rev. 05-01-2008) , 
SECRET//NOFORN 


FEDERAL BUREAU OF INVESTIGATION 


that information “upgraded” to the classified level when 
requests for public disclosures were received. This practice was 
described as necessary for state department officials to share 
time sensitive information in real time. This type of 
communication resulted in a high number of B(1) exemptions 
during the Freedom of Information Act (FOIA) review process.. 
Both IG’s emphasized these B(1)exemptions were separate and 
distinct from the classified information referenced in the 
811(c) referral. The emails referenced in the referral were 
classified prior to being sent and derived from sensitive 
sources and methods from the intelligence community. 


Wyse ppm Both IG’s will continue their reviews: of the 
FOIA process and will provide their findings to the FBI and 
appropriate Congressional committees. Both IG’s also agreed not 
to disclose the existence of an FBI investigation or any actions 
the FBI may be conducting as part of referenced investigation. 


(U/ PEs) The following representatives attended the meeting: 


.1) Robert A, Jones, Deputy Assistant Director, FBI 
2) Assistant Section Chief, FBI 
3) | Assistant Section Chief, FBI 
4) Special Assistant to the Deputy Assistant 
‘Director, FBI 
5) son, Deputy General Counsel, FBI 
6) Assistant General Counsel, FBI b3 per ODNI 
7) Special Agent, FBI b6 per FBI, ODNI 
. 8) Special Agent, FBI b7C per FBI, ODNI 
9) Intelligence Analyst, FBI 
10) George Toscas, Deputy Assistant Attorney General, DOJ 
11) David Laufman, Chief, DOJ/Counterespionage Section (CES) 
12) Deputy Chief, DOJ/CES 
13) Attorney, DOJ/CES 
14) ral, ICIG 
15) 
16) 
17) , Inspector General, STATE IG 
18) STATE. IG 
19) STATE IG 
¢ 
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LAW OFFICES 


WILLIAMS 8&8 CONNOLLY LLP 
725 TWELFTH STREET, N.W. 
WASHINGTON, D. Cc. 20005-5901! EDWARD BENNETT WILLIAMS (1920-1988) 


DAVID E. KENDALL PAUL R. CONNOLLY (1922-1978) 
(202) 434-5145 (202) 434-5000 


@we. 
dkendall@wc.com FAX (202) 434-5029 


August 10, 2015 


ational Security Division b7c 


Department of Justice 
Washington, DC 20530 


De{____ bé 
b7C 
Thank you for your letter, dated August 7, 2015, and sent to us by email slightly after 6:00 pm on 
that date, regarding our voluntarily providing the FBI certain server and related equipment, presently in 
the custody of Platte River Networks, on which emails to or from former Secretary Clinton’s 
@clintonemail.com account were stored from 2009 to 2013. 


In voluntarily providing this server and related equipment to the FBI, we, of course, are doing so 
solely with regard to former Secretary Clinton’s @clintonemail.com account and not to any other 
accounts not utilized by former Secretary Clinton which might at one time have been hosted on this 
server equipment. While | believe, as | have told the Benghazi Select Committee, that, based on 
technologists’ advice to me, there are no email accounts or related data currently residing on this server: 
equipment, out of an abundance of caution, I wanted to emphasize that the only authority | have relates 
to the former Secretary’s account. Please advise me if the FBI’s review discovers any other account 
data, including other email account data, so that we may take remedial steps immediately. 


eciely. 


wee 


us 


is 
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Collected Item Log 


QOrricia, Recorno 
Document participanis have digitally signed, 
All signatures have been vanfied by & 
certked FB) infarmation system. 


Event Title: (U) Midyear Exam Date: 08/18/2015 


Case ID [oT (S7AET yy MIDYEAR EXAM; 
nr. 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


eclassify On: 
Full Investigation Initiated: 07/10/2015 


Collected From: (U) 
Department of State 


Receipt Given?: No 


Holding Office: WASHINGTON FIELD 


Details: No Details Provided 
Item Type Description 
1B Digital (U) (1) One white/grey Lexar USB 3.0 thumb drive "Dept 


of State 703-312-3856" sticker 

Collected-On: 08/14/201 

Seizing Individual: 

Collected By: 

Location Area: NA 

Specific Location: NA 

Device Type: USB Micro Storage Device (thumb drive) 
Make: Lexar ; 

Number of Devices Collected: 1 


SECRET//NoFeRIT 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its 
contents are not to be distributed outside your agency. 


b6 
b7c 


b3 
bTE 


b6 per DOS 
b7C per DOS 
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; ALL 2B1 TNECRMATION GONTAIN 


FD-302a (Rev. 10-6-95) 
-1- 


FEDERAL BUREAU OF INVESTIGATION = 5, PSz_POS: PRE 


b7C per DOS, FBI 


Date of transcription _ 08/17/2015 


on August 14, 2015,[ trom the 
U.S. Department of State (STATE), Office of the Inspector General 
(OIG), 2121 Virginia Ave., N.W., Washington, D.C., met at their place 
of employment pursuant to an agreement reached between STATE and the 
FBI to voluntarily turn over a thumb drive containing the STATE .pst 
email files for HUMA ABEDIN and CHERYL MILLS. At 11:30am, SA 
signed a receipt and accepted custody of the item described in detail 
below: 


Item 1: A white and grey 32GB Lexar USB 3.0 thumb drive bearing a 


Sticker on the reverse “Dept of State 703-312-3856” 
b6 per DOS 


; b7C per DOS 
Item 2: Yellow note bearing the password [ 


Subsequent to the FBI’s collection of the above, Items 1 & 2 were. 
transported to the Washington Field Office of the FBI where they were 
entered into evidence, and given 1B numbers. Copies of the intake 
sheets and FD-1004 are enclosed with this communication. 


Items 1 & 2 were then transported to the FBI’s Forensic Analysis 
Unit to Quantico, Virginia for storage and evaluation. 


Investigation on 08/14/2015 at Washington, D.C. _ . ne 
Files _| as Date dictated___ N/A b6 
b7C 
b7E 
By S 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
HRC-57/5 


na ) 2 


DEL LASSI FIED BY: RI gS bah sa i 
ie) Lususe — 
7 , _ Ben : 


Evidence Details ie b3 
Case: iio ee item: 1B26 b7E 


Description: (U) (1) One white/grey Lexar USB 3.0 thumb drive "Dept of State 
703-312-3856" sticker (Only paper work submitted) 


Coliected On: 08/14/2015 11:30 AM EST 


Receipt item #: None Special Handiing: None 
CATS iID#: None Hazardous Materiais: None 
FBi Seizure #: None 
CATS Abandonment #: None Abandonment #: None 


Digital Information 
Type: USB Micro Storage Device (thumb drive) 
' Make: Lexar 
Batteries Charged: No 
Number Coiliected: 1 
Coliected by CART: No 


Discovery Location b6 
Area:_NA : b7C 
Seizing Individual: Coiiected By: 
Specific: NA Others: None Others Agency: 
None 


Anticipated Disposition 
None on None 


Storage Information 
Holding Office: WASHINGTON FIELD 


: b6e 
Finalized yf Last Inventory: None  b7ec 


Location: E1167159 - ECR1, MAIN EVIDENCE CONTROL CENTER (B112) WFO-HQ 
Barcode #: £5490178 


Chain of Custody 
Shipping / Transfer Log 
History 


Acquisition Event Details 
Acquisition Event: (U) Midyear Exam 


b6 per DOS 


Collected From: (U) b7C per DOS 


Department of State 
Recelpt Glven: No 


Holding Office: WASHINGTON FIELD 


b3. 
Serial 55 
HRC-5/76 


of | 8/18/2015 1:34 PM 
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ve (l) 


Title: S8@NF) MIDYEAR EXAM; Date: 08/12/2015 
MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


From: Counterintelligence Division 


Counterespionage Section b3 

Contact: AS bé 
b7C 
b7E 


Approved By: Kable Charles H. 


pratteaBy: | 
CaseIDA(UL___ sd -G 
b3 per ODNI 


: ing with Intelligence Community Inspector General (ICIG) staff, 37 Pec, opnz 
ion July 13, 2015. 


Enclosure(s): (U) CD-Rom labeled “S//SI//NF”, spreadsheet index of files, FOIA workflow chart, 

as ¢ b3 per ODNI : 
and original meeting notes. Be Ce ODN: ERE 
b7C per ODNI, FBI 


Details: _(U/ On July 13, 2015 ASC etwithICIG Inspectof___| 
regarding classified e-mails they foundona_ . 
unclassified system. ; 


i st rovided a CD-Rom with 296 redacted e-mails and 40 unredacted °? Per OPNI 
b6 per ODNI 


e-mails whic had queried imately 30,000 e-mails provided to Departn, 5. per ODNI 
of State (DoS) by Hillary R. Clinton. used keyword searches to extract these 40 


e-mails that he believed may contain classified informatio Iso provided a spreadsheet 
of e-mails he suspected of containing classified information. 


(u//Feue) [indicated the ICIG has formally requested a copy of the 
30,000 e-mails from Patrick Kennedy, Under Secretary of Management at DoS with a deadline of 
Friday, July 10, 2015. re provided a FOIA workflow diagram of DoS’s process 


for reviewing the e-mails for sensitive information. b3 per ODNI 
b6 per ODNI 


b7C per ODNI 
o¢ 
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: : b3 
Re: (U)[ ss Date: 08/22/2015 | . ie 


Precedence: ROUTINE © Date: 08/22/2015 
To: CD-4, Counterespionage Section Attn: 
From: CD-4 


Approved By: Kable Charles H. IV RS 


b7Cc 


Drafted By: 
— 


case iD #: (uy[ bre 


Title: Us(/NE) MIDYEAR EXAM 


b6 per DOS 
b7C per DOS 


D54B29873 
dated 20130301 


y On: 20400822 


Attachment(s): (U//FOUe) A print-out of the email and the four 
.pdf files mentioned below. b6 per DOS, FBI 
, b7C per DOS, FBI 
Details: (U//FO8Q) On August 19, 2015, after an interview 
earlier that same day with writer and SA 
provided writer with an email that contained follow-up 
information within four separate attachments. 


(u/frose)| id first attachment was a >pdf file P& Per DOS 
saved as “11-STATE- Tem. pdf” and it was an official sTaTE >7’° per DoS 
correspondence from June 28, 2011 from then Secretary of State 

Hillary CLINTON with subject line of “Securing Personal E-mail 
Accounts.” CLINTON informed recipients they “should exercise 

caution and follow best practices in order to protect personal 

e-mail and prevent the compromise of government and personal 
information.” CLINTON later stated, due to “recent targeting of 
personal e-mail accounts by online adversaries,” STATE employees 

should “avoid conducting official Department business from 

[their] personal e-mail accounts.” 


_SESRETL/NOFORN- 


HRC-675 


© SECRET] Aierenn- e 


To: CD-4 From: _CD-4 
Re: (uf atte: 08/22/2015 


(u/prosal | second attachment was a .pdf file 
saved as “MemoPreservingEmailofSeniorOfficials.pdfi” and it was a 
memorandum with three attachments of its own that were 
distributed to senior STATE officials on August 28, 2014 from 
Patrick KENNEDY, Under Secretary of State for Management with 
subject line “Senior Officials’ Records Management 
Responsibilities.” The memorandum stated “senior officials’ 
records are generally the most important documents created 
within” STATE and that senior officials themselves were 
responsible to ensure “all records made or received in the 
conduct of agency business regardless of physical format or 
media” should be preserved. 


(U//FORSe.) As stated above, KENNEDY’s memorandum 
included three attachments. KENNEDY’s first attachment listed 
all positions designated as Senior Officials Positions at STATE. 


(U//FOUS) KENNEDY’s memorandum’s second attachment 
included 5 Foreign Affairs Manual (FAM) 440. Specifically, 5 FAM 
443.2 “Which E-Mail Messages are Records,” published October 30, 
1995, instructed STATE officials that e-mail messages are 
federal records when they “are made or received by an agency 
under Federal law or in connection with public business” with 
examples given as “records that document the formulation and 
execution of basic policies and decisions and the taking of 
necessary actions; records that document important meetings; 
records that facilitate action by agency officials and their 
successors in office; records that make possible a proper 
scrutiny by the Congress or other duly authorized agencies of 
the Government; and records that protect the financial, legal, 
and other rights of the Government and of persons directly 
affected by the Government’s actions.” Additionally, 5 FAM 
443.5 “Point to Remember About E-Mail,” published October 30, 
1995, informed STATE officials that “certain e-mail messages 
that are not Federal records may still be subject to pending 
requests and demands under the Freedom of Information Act, the 
Privacy Act, and litigation and court orders, and should be 
preserved until no longer needed for such purposes.” Later, 5 
FAM 443.5 stated “classified information must be sent via 
classified e-mail channels only, with the proper classification 
identified in each document.” 


(U//FEVQ) KENNEDY’s memorandum’s third attachment was 


entitled “Instructions for Preserving Email of Departing Senior 
Officials” with date of August 2014. 


“BBSRET//wOPORN 
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To: CD-4 From:  CD-4 b3 
Re: (U)[ sd Date: 08/22/2015 b7E 


(U/ / Peso) [J thira attachment was a .pdf file y¢ per pos 
saved as “12 FAM 540.pdf” and it covers Sensitive But b7C per DOS 
Unclassified Information (SBU). Specifically, 12 FAM 544.2 
“Automated Information System (AIS) Processing and 
Transmission,” published November 4, 2005, stated “employees who 
will be transmitting SBU information outside of the Department 
network on a regular basis to the same official and/or most 
personal addresses, should contact IRM/OPS/ITI/SI/PKI to request 
assistance in providing a secure technical solution for those 
transmissions..Employees participating in the home PKI and 
telework program must complete the requisite training and sign 
an acknowledgement statement prior to being issued the approved 
security measures/equipment.” 12 FAM 544.3 “Electronic 
Transmission Via the Internet,” published November 4, 2005, 
stated it is the STATE’s “general policy that normal day-to-day 
operations be conducted on an authorized AIS.” Additionally, 
STATE “is expected to provide, and employees are. expected to 
use, approved secure methods to transmit SBU information when 
available and practical” and “employees should be aware that 
transmissions from the [STATE’s] OpenNet to and from non-U.S. 
Government Internet addresses, and other .gov or .mil addresses, 
unless specifically directed through an approved secure means, 
traverse the Internet unencrypted.” 12 FAM 545 “SBU/NOFORN 
Information,” published November 4, 2005, stated “employees must 
process and transmit SBU/NOFORN information only on a system 
authorized by the [STATE] for classified information 
transmission, storage and processing.” 


. (u//rese)[ fourth attachment was a .pdf file 
saved as “14 STATE 128030.pdf” and it was an official STATE bé6 per pos 
correspondence. from October 30, 2014 from Secretary of State b7c per Dos 
John KERRY with subject line of “State Department Records 
Responsibilities and Policy.” KERRY stated senior officials may 
delete personal emails, but that the definition of a personal 

email was very narrow. KERRY stated in the very limited 
circumstances when it is necessary to use one’s personal email 
accounts for official business, that email would still need to 

be preserved in one of STATE’s official electronic records 

systems. KERRY recommended STATE employees to forward official 
emails from their personal email account to their STATE account 

and reiterated that personal email accounts should not be used 

for classified information. 
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: b3 
Re: (Uf Date: 08/22/2015 — 
Precedence: ROUTINE Date: 08/22/2015 


To: CD-4, Counterespionage Section Attn: 


From: CD-4 


b6 
contact: sat Be 
Approved By: Kable Charles H. w Yee —— 


Drafted By: 


. b7E 


Title: 0s¢7NF) MIDYEAR EXAM 


I by 


United States Department of State (STATE). 


b6 per DOS 


D54B2987 BIC per DOS 


SIC dated 20130301 


Attachment(s): (U//Fe8e) A print-out of the email and the two 

.pdf files mentioned below. b6 per DOS, FBI 
. . b7C per DOS, FBI 
Details: (U//Fes8e) On August 17, 2015, after an interview 
earlier that_same day with writer and SA 

provided SA[___sJwith an email that contained some follow-up 
information and two attachments. 


(U//PEBS) One attachment was a .pdf file of civil 
action number 15-cv-123, Jason Leopold, Plaintiff, v. U.S. 
Department of State, Defendant, entitled “Notice of Filing 
Declaration of John F. Hackett.” This attachment contained 
Hackett’s full declaration from May 18, 2015, wherein he 
detailed his position as lead STATE official responsible for 
responding to requests for records under the Freedom of 
Information Act (FOIA) and described the core responsibilities 
of IPS. Furthermore, the declaration described STATE’s plan to 
review approximately 55,000 pages of emails and attachments that 
former Secretary of State Hillary Clinton provided to the STATE 


_SEDREI//NOFORN 
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“SEGRET7/NOFORIT 


To: CD-4 From: CD-4 


Re: (U) [ ate: 08/22/2015 b3 
, b7E 


in December 2014 along with a date by which STATE proposed to 
complete that review and production. The declaration also 
contained the text of the October 28, 2014 letter sent by Pat 
Kennedy, STATE Under Secretary for Management, to former 
Secretaries of State Madeleine Albright, Colin Powell, 
Condoleezza Rice, and. Hillary Clinton whereby Kennedy requested 
that copies of any federal record be made available to STATE for 
preservation. 


(U/AFoue} The second attachment was a .pdf file of 
civil action number 15-cv-123, Jason Leopold, Plaintiff, v. U.S. 
Department of State, Defendant, entitled “Defendant’s Status 
Report Regarding Release of Records on July 31, 2015.” This 
attachment contained a status report from Hackett regarding 
STATE’s release of the non-exempt portions of records subject to 
FOIA contained in the emails provided to STATE by former 
Secretary of State Clinton. In the declaration, Hackett 
described (1) the specific steps taken as part of the FOIA 
review; (2) the exact number of pages already and planned to be 
produced through September 30, 2015; and (3) how STATE had 
recently integrated, based on a recommendation from the 
Intelligence Community Inspector General, Intelligence Community 
reviewers to assist in the large undertaking. b6 per DOS, FBI 

b7C per DOS, FBI 


(U/ ided the date of April 28, 2015 
as the date where attorney, STATE’s Office. of 
Congressional Affairs, to members of the Department of 


Justice, the staff of the Office of Legal Adviser, and 

IPS staff, that she did not understand why the FOIA review of 
the 296 emails related to Benghazi was taking so long. 

also repeatedly stated that the emails had already gone through 
the inter-agency review process and there was nothing classified 
in the emails. 
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Import Form 


Form Type: Court . Date: 09/01/2015 


o b7C 
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92 Tepainy 
Case ID # [ 82 (SPACE) MIDYEAR EXAM 3 


MISHANDLING OF CLASSIFIED; bIE 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


(o) 


Synopsis: (U// Fete) (SPARE) The captioned investigation is highly 
sensitive and considered a prohibited investigation. Additionally, the 
investigation is designated a SIM and has an exemption for uploading 


approved by AD Randall Coleman Serial 1). b3 


b7E 


Derived 
Sources 
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U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


David E. Kendall, Esq... 
Katherine M. Turner, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


August 6, 2015 


Dear Mr. Kendall and Ms. Turner, 


This letter confirms your intent to voluntarily produce to the Federal Bureau of Investigation (“FBI”) 
three thumb drives (which you have represented to be one original and two copies thereof) each 
purportedly containing 30,490 emails to or from Secretary Clinton’s @clintonemail.com account that you 
previously provided in hard copy to the Department of State in December 2014, as well as hard copies 
and a laptop computer in your possession containing emails to or from the @clintonemail.com account. It 
is our understanding that the items described above (hereinafter “the Materials”) constitute the entirety of 
your client’s and your possession of emails to or from the @clintonemail.com account, aside from six 
additional laptop computers we previously discussed by phone. It is also our understanding that those six 
laptop computers contain emails to or from the @clintonemail.com account; however, in addition to the 
emails, the laptop computers also contain privileged material. As such, we will work with you to 
appropriately secure the emails contained on those laptop computers. If any of these understandings are 
incorrect, or if you find any additional emails to or from the @clintonemail.com account, please notify 


me promptly. 


5 lan i ar i ln dn i sats cm) Palestro 


On July 31, 2015, the FBI delivered to Williams & Connolly a letter requesting that you preserve records 
related to the @clintonemail.com account. We understand that you have also received other requests to 
preserve records related to the @clintonemail.com account, including a July 29, 2015 preservation letter 
from Senator Ron Johnson, Chairman, United States Senate Committee on Homeland Security and 
Governmental Affairs; a May 26, 2015 preservation letter from Steve A. Linick, Inspector General, 
Department of State and I. Charles McCullough, III, Inspector General, Intelligence Community; and a 
March 3, 2015 preservation letter from Representative Trey Gowdy, Chairman, House of Representatives _ 
Select Committee on Benghazi. You have also represented that you will require contitiued access to the 


Materials on behalf of your client. 


Once taking custody, the FBI will maintain the Materials in an appropriately secure manner. We believe 
such maintenance satisfies any preservation obligations you may have. We will facilitate your continued 
access to the Materials as may be necessary and appropriate in a secure space at the Litigation Security 
Group, Department of Justice, at 145 N Street NE, Washington, DC 20002. 


Sincere] 
b6 


b7C 


HRC-682 


ALL INSULATION CONTAINED 


r ; HERE 1S US LASSI Ie . 
DATE 1L-Ue-2016 EY J76JL5780 HSICG 


FD-941 (2-26-01) 


CONSENT TO SEARCH COMPUTER(S) 


 Gatneene M.Tuenee 


Federal Bureau of Investigation (FBI) to permit a complete search by the FBI or its designees of any and all computers, 


have been asked: by Special Agents of the 


any electronic and/or optical data storage and/or retrieval system or medium, and any related computer peripherals, 


described below: 


Lens Tew Pal Tyr9 PB - Yo%I? 2/3 
CPU Make, Model & Serial Number (if available) 


Levayv Macon [66 Blad a Sven LIpITICG - 000100101 


Storage or Retrieval Media, Computer Peripherals 


Lear Miunn 968 Guew Whee LTT 8GB- O00 - TAU 
wi Shon 9 6B flute — DTSET (Copy 2) 


Williams & Connelly LLP, 725 12th Street, N.W. Washington, D.C. 20005 ‘which I own, possess, 


and located at . 
control, and/or have access to, for any evidence of a crime or other violation of the law. The required passwords, logins, 


-  OSwnawPe: o\ imt evuet oul 
and/or specific directions for computer entry are as follows: ‘wo aed ; evn ul ‘ ! 


I have been advised of my right to refuse to consent to this search, and I give permission for this search, freely 
and voluntarily, and not as the result of threats or promises of any kind. 
I authorize those Agents to take any evidence discovered during this search, together with the medium in/on which 
it is stored, and any associated data, hardware, software and computer peripherals. 
August 6, 2015 
Dae Cts 


August 6, 2015 
Date 


, Special Agent 
Printed Full Name of Witness 


Washington, D.C. 
Location 


HRC-683 
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ALL TMPORMATION Cowratwen 
& HEREIN 1S UNCLASSIFIED 

2.8 7 DATE 11-09-2016 BY J7601eTSO0 NSicc 

FD-597 (Rev. 4-13-2015) Page | of I 


UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 


: = Receipt for Property = =  .. 
‘eww: [ | brs 


On (date) 98/06/2015 ‘item (s) listed below were: 
: Collected/Seized 


Received From 
Returned To 
Released To 


Ono 


(Name) Williams & Connelly LLP 
(Street Address) 725 12th Street, NW 


(City) Washington, D.C. 20005 


Description of Item (s): 


L&voyo Fut AD TYZO 5s PB-ycd12 12 foz® 


Mic itor /¢C& chad Snvée. $f LTorrib & -000-1001 D4 (obium 


ELA tit OB Géiip Sy LX DT L4G - 000-1 TAY 
CiasTouw & Sie S/n gir: 
22 Benes of Contre [alee Sec tans [ado Des Dv. Zor 
Mins t& PELL CMATER CAMFIZD A€ Tar Sl Cou” 


"Received By: Received From: 


(Signature) 


williams & Convelly UY, 
Parker HRC-684 


Printed Name/Title: 


UR LASSI EIED Ay NSlD 2a oebTsa 


 inm£§ 8 mm 


E5490156. : 


b7E 


Description: (U) 1 Lexar micron 16 GB Black & Silver Thumbdrive - 
LIDTT166-000-1001 DA (Original) lLexar Micron 8 GB Green and White 
LJDTT8GB-000-117AU (Copy 1) 1 Kingston 8GB Silver DT SE9 (Copy 2) 


(Only paperwork submitted) 


CollectedOn: 08/06/2015 03:00 PM EST 
Receipt Item #: None Special Handling: None 
CATS ID #: None Hazardous Materials: None 


FBi Seizure #: None 
CATS Abandonment #: None Abandonment #: None 


Digital Information ; 
Type: USB Micro Storage Device (thumb drive) 


Batteries Charged: No 
Number Collected: 3 
Collected by CART: No 


Discovery Location 


Area: 


Specific: NA ‘ . Others: None Others Agency: 5 2, 


None 


Anticipated Disposition 
None on None 


Storage Information 
Hoiding Office: WASHINGTON FIELD 


b6 


Location: 1167159 - ECR1, MAIN EVIDENCE CONTROL CENTER (B112) WFO-HQ b7c 


Barcode #: £5490156 


Chain of Custody 
Shipping / Transfer Log 
History 


Acquisition Event Detaiis 
Acquisition Event: (3X Midyear Exam 


Collected From: (U) Katherine Turner, Esq 
Williams & Connolly, LLP 
725 12th Street, NW 
Washington, 


’ Receipt Given: No 
Hoiding Office: WASHINGTON FIELD 


Evidence Log: Le ; b3 
eria b7E 


HRC-685 


1 of 1 eG 4:01 PI 


LRU LASSI PIED Ay NSiD 2a 7 CebTsa 


“niin «=6=6)—h( ©} —— 
5490187 


b3 


case: L____ tem: 182 bTE 


Description: (U} Lenovo Think Pad T420 PB-YC912 12/03 (Only paperwork submitted) 


Collected On: 08/06/2015 03:00 PM EST 


Receipt Item #: None . Special Handling: None ; 
CATS ID#: None Hazardous Materials: None 
FBI Selzure#: None 
CATS Abandonment #: None Abandonment #: None 


Digital Information 
Type: Tablet Computer 
Batteries Charged: No 
Number Collected: 1 
Collected by CART: No 


Discovery Location , 
Area: NA 
seizing Individual: [_] collected By:[__ 
Specific: NA Others: None Others Agency: 
None b6 


a . sas b7Cc 
Anticipated Disposition 
None on None 


Storage Information 
Holding Office: WASHINGTON FIELD 


Finalized By: [ Last Inventory: None b6 


b7C 
Location: #1167159 - ECR1, MAIN EVIDENCE CONTROL CENTER (B112) WFO-HQ 
Barcode #: £5490157 
Chain of Custody 
Shipping / Transfer Log 
History 
Acquisition Event Detaiis 
Acquisition Event: Oxf Midyear Exam 
Collected From: (U) Katherine Turner, Esq 
- Williams & Connolly, LLP 
725 12th Street, NW 
Washington, 
Receipt Given: No 
Holding Office: WASHINGTON FIELD 
Evidence Log: b3 
Serial 20 bT7E 
HRC-686 


lof 1 8/6/2015 4:03 PI 


i 


F 


D 


FOI/PA 


Total 


ED 


KRALL 


BUREAU OF INVESTIGATION 


FOI/PA 


EL 


ETED 


PAGE INFORMATION SHEET 


Page 20 


1353814-0 


Deleted Page(s) = 2 
~ b3; b6; b7C; b7D; b7E; 
Page 21 ~ b3; b6; b/7C; b7D; b7E; 


XXXXKXXKXXAKXXKXXAX XX KK XA XK XXX 


Xx Deleted Page(s) x 
xX No Duplication Fee X 
Xx For this Page Xx 


XXXXKXXKXXKXXKXXKX XX KK XKXXK XXX 
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HEBEIN IS UNULASSIP le 
DATE 11-05-2016 BY G7631e7e0 Halle 


® “BLL £BI INPORIATION CONTAIVeED 


LAW OFFICES 
WILLIAMS & CONNOLLY LLP 
725 TWELFTH STREET, N.W. . 
_ WASHINGTON, D. C. 20005-5901 EDWARD BENNETT WILIAMS (1920-1988) 


PAUL R. CONNOLLY (1922-1078) 


DAVID E. KENDALL 
(202) 434-5145 {202) 434-5000 


dkendall@we.com 
FAX (202) 434-5029 - 


October 1, 2015 


BY EMAIL AND FIRST CLASS MAIL 


b6 


United States Department of Justice ag 


National Security Division 
600 E Street, NW 
Washington, DC 20530 


Del | % 
b7C 
Pursuant to our recent conversations, this letter provides the Department of 
Justice with consent to search former Secretary Clinton's files on the current Platte River 


server for the period January 21, 2009 to February 1, 2013 for evidence relevant to your 
security inquiry. 


We request and anticipate that at the conclusion of your inquiry you will return to 
us the former Secretary’s non-federal record, personal e-mails. 


Sincerely, 


KA & aLy/ 


David E. Kendall 
DEK/bb 


HRC-736 


wi ALL FRI INFORMATION CONTAINED 
© HEREIN TS CRCLESe rr ren 
DATE 11-09-2016 BY J76J18Ts0 Weice 


(wr) (FBI)  -b6 
b7C 
From: Lo Ro) (FB 


Sent: Thursday, October 01, 2015 12:18 PM 
To: (WF) (FBDL__ SWF) (FBI) 


Subject: FW: Cor dence from W&C 
Attachments: Letter to Consent.pdf 


FYSA and submission to file. 


From —_](nsb) (mate! 1] . 


Sent: Thursday, October 01, 2015 12:11 PM 

To; (WF) (FBI) D) (FBI); (Ro) (FBL__) (oc) (FB) 
Cc (NSD) (JMD) (USAVAE) USAVAE) 

Subject: Correspondence from W&C 

All: 

Attached is a letter that just came in from wc | __hnd I will still need to send a letter to Latham & Watkins and 6 
W&C memorializing the process to be used with server (in two stages, etc.). We are working on revising that and will >7° 


circulate to the group. When we send drafts, please review as quickly as possible and get back to us, as we are trying to 
keep things moving. 


ao 7 
7" bTC 
b6e 
. b7C 
ounterintelligence and Export Control Section 


National Security Division 
U.S. Department of Justice 


HRC-737 


b6 
b7C 


HRC-738 ” 


b3 
b7E 


b6 
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HRC-745 


ALL 251 INECRMATION GONTAIN 
: ® BEBEIN 15 JNCLASS o 
: DATE 11-03-2016 By G7651 8780 NSIC. 


(WF) (FBI) | b6 
b7C 


From: Cr) (FB) 


Sent: Wednesday, October 14, 2015 8:07 AM 
To: WE)\(FBN; WE) (FBI): 
(WF) (FBI) WF)(FBI); (WF) 


(FBI) 
Subject: FW: Classnet Banner --- UNCLASSIFIED 
SentinelCaseld: ' NON-RECORD 


Classification: UNCLASSIFIED 


Washington Field Office, CI-13 b7C 


From; (CD) (FBI) . b6 


Sent: Tuesday, October 13, 2015 3:51PM pic 
To decoy (Fen 9) | 


Subject: Classnet Banner --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Below is acopy of the banner that is on the State Classnet (Secret side) system. 


z 


OLD 
BANNEROOO1.PDF 


The banner is the same on the open net (unclass) computer with the exception of one additional last sentence which 
reads as follows: 


Opening e-mails form unknown/unconfirmed websites may open the Department's system to malware. 


Here is the banner from the Unclass GO system which is what is seen when you log into the unclass system from an 
outside computer using a fab and pin code. 


be) 


GO BANNER ON 
JNCLASS0001.PDF 


HRC-746 


! 


| am still working on getting you the banner from the TS side as well as a full printout copy of the banner on the Open 
net (unclass). 


Classification: UNCLASSIFIED 


HRC-747 


‘ou are accessing a U.S. Government information system, which includes (1) this 
computer, (2) this computer network, (3) all computers connected to this network, 
land (4) all devices and storage media attached ta this network or to 4 computer 
fon this network. This information system is provided for U.S. 
iGaovernment-authorized use only. 

{Unauthorized or improper use of this system may result in disciplinary action, as 
(well as civil and criminal penalties. 

i y using this information system, you Understand and consent to the following 

|.” You have no reasonable expectation of privacy regarding any 

I... communications or data transiting ar stored on this information system. At 

1... any time, and for any lavwful government purpose, the government may 

= monitor, intercept, and search and seize any communication or data transiting 
}.....0f stored on this information system. 

1.."_Any communications or data transiting or stored on this information system may 
|.....be disclosed or used for any lawful government purpose, 

INothing herein consents ta the search or seizure of a privately-owned computer 
for other privately owned communications device, or the contents thereof, that ts 
‘in the system users home. 


HRC-748 | 


ee ©@ 
e Home 


e Required System Setup 
© Required System Setup - Windows 
© Required System Setup - Mac 
© Required System Setup - Kiosk 
e HELP 
Check Your Connection Speed 
User Guides 
o Quick Guides 
o Quick Guides for Mobile Devices 
o Full User Guides 


GO Message Board 


SYSTEM STATUS as of 10/13/2015: 
To properly log off GO, please follow the instructions below: 


1. Save and close any files that you wish to continue working on later. 

2. Within the GO session, click the Start button located at the bottom left of the GO 
window. 

3. Select Log Off. 

4. When the window turns black, expand the menu by clicking the downward arrow 
located at the top and select Disconnect. 

5. From the application screen that displays your User Desktop, select Log off located at 
the top right. 

6. Once logged off, you should see a confirmation screen confirming that "You have 
been logged off. See you again soon. For security reasons, you must close this browser 
window." 


Instructions can also be found in the GO User Guides. Failure to log off correctly will 
cause your session to hang. 


Customers using IE, Version 11 to log into Global OpenNet(GO) should click here 
for important instructions on how-to configure browser settings. If the link does not 
work, please follow the steps below. 

1. Click on Required System Setup 

2. System Setup for Windows 7 User Guide and 

3. go to page 18 for instructions. 


ANNOUNCEMENT(S): Windows 10 GO Compatibility: The Windows 10 
Operating System (OS) has been tested and confirmed to be compatible with Global 
OpenNet (GO). For customers using the Windows 10 OS, please reference the 

. Windows 10 User Guide found here or by clicking the "Required System Setup" tab 
above. 


HRC-749 


In order to access this system you must read and accept the following 
system monitoring consent notice. Please use the scroll bar to the right. 


You are about to enter a Department of State computer system or network. 
Use by unauthorized persons, or for unauthorized personal business, is 
prohibited and may constitute a violation of 18 U.S.C. 1030 and other Federal 
law, as well as applicable Department policies and procedures. 


You have NO REASONABLE EXPECTATION OF PRIVACY while using 
this computer system or network. All data contained and/or activities 
performed herein may be monitored, intercepted, recorded, read, copied, or 
captured in any manner by authorized personnel. System management 
personnel or supervisors may give law enforcement officials or appropriate 
Department managers any potential evidence of crime, fraud, or employee 
misconduct found on this computer system or network, and employees may be 
subject to discipline for misuse. Furthermore, law enforcement officials may 
be authorized to access and collect evidence from this computer system or 
network, or from any portable devices that have been connected to this 
computer system or network. Nothing herein consents to the search or seizure 
of a privately-owned computer or other privately owned communications 
device, or the contents thereof, that is in the system user's home. Therefore: 


e USE OF THIS COMPUTER SYSTEM OR NETWORK BY ANY 
USER, AUTHORIZED OR UNAUTHORIZED, CONSTITUTES 
EXPRESS CONSENT TO THIS MONITORING. 

e IF YOU DO NOT CONSENT TO THIS MONITORING, OR IF YOU 
ARE NOT AN AUTHORIZED USER PLEASE CLOSE YOUR 
BROWSER TO EXIT THE SYSTEM. 


For help, please contact the IT Service Center (ITSC) at 1-877-246-9493 if you need assistance after 


you have completed the installation steps as outlined in the GO User Guides. 


Home | Required System Setup | HELP | Check Your Connection Speed | User Guides 
U.S. Department of State - Global OpenNet 


HRC-750 


b3 
b6 
b7C per 
b7E FBI 


HRC-751__ 


ALL Bl [NZORMATION CONTAINED 


nn. Is UNCLASSIFIED panama y 
be di-O03-2016 By GibGLeTso Belle ; 


LAW OFFICES 
WILLIAMS 8 CONNOLLY LLP 
725 TWELFTH STREET, N.W. 


DAVID E. KENDALL WASHINGTON, D. C. 20005-5901 EDWARD BENNETT WILLLAMS (920-1988) 
i . PAUL R. CONNOLLY 922-1978) 
(202) 434-5145 ; (202) 434-5000 


dkendall@we.com 
. FAX (202) 434-5029 


October 14, 2015 


BY EMAIL AND FIRST CLASS MAIL 


i i b7 
United States Department of Justice ; 


National Security Division 
600 E Street, NW 
Washington, DC 20530 


b6 
Deaf__ Ns bc 


We have made a good-faith effort to identify equipment or devices that might 
contain or might have contained emails from the time period January 21, 2009 to 
February 1, 2013 (the “relevant time period”) to or from any @clintonemail.com domain 
account assigned to former Secretary Clinton. Based on information we have access to, 
we can report the following. 


We have identified two Blackberry devices and one iPad that we believe the 
former Secretary may have used during the relevant time period. 


In connection with your request, we also note that we understand that in 2008 
and early 2009, an Apple computer stored in the Clinton’s Chappaqua home was used as 
an email server. We have been unable to determine whether that Apple computer ever 
functioned as a server for the @clintonemail.com domain account in early 2009, prior to 
the March 2009 installation of the Dell server that we provided to the Department of 
Justice in August 2015. Based upon our best information, we do not believe that it did, 
but cannot rule out that possibility. We believe that the Apple computer was repurposed 
after the installation of the Dell server in March 2009, to serve as a personal computer for 
household staff. The Apple computer was replaced in 2014 by an iMac, to which its then- 
existing data was transferred. Thereafter, the hard drive of the Apple computer was 
discarded. The iMac is currently in daily use by household staff, including aides to 


x, 
* 


HRC-752 


WILLIAMS 8 CONNOLLY LLP 


b6 
b7C 
ctober 14, 


Page 2 


President Clinton, and is also used primarily to store personal family files. We have 
conducted a review of the names and types of files in user-visible folders on the iMac and 
have found no emails from the relevant time period belonging to the former Secretary. 


. In the event that we become aware of any other equipment or devices that | 
contain or contained any emails from the relevant time period to or from any 
@clintonemail.com domain account assigned to former Secretary Clinton, we will inform 
you. , 


Sincerely. 


5 


David E. Kendall 
DEK/bb 


HRC-753 


b6 
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HRC-761 


HEREIN [5 UN LASSIE LED 
Le div DS 2016 Be GibGLeTeo Helle 


b7C per DOS, FBI 


i @ ALL FED [NPORUATION CONTAINED 


From: 


Sent: N ber 02, 2015 3:48 PM 
To: 
Ce: 
Subject: : esponse 
Attachments: _ Mydocument.pdf 
b6 
Good Afternoon|__| b7c 


Attached is the response from INR Bureau. This response in addition to the hard copies provided earlier by the 
Executive Secretariat completes the request from the FBI memo dated 10/20/2015. 


All the Best, 


ee ae 


Bureau of Diplomatic Security 
Office of the Assistant Secretary _ 
Tel 

Emai 


b6 per DOS 
b7C per DOS 


Fro b6 per DOS 


Sent: Monday, November 02, 2015 3:37 PM b7C per DOS 
T Pee 
Subject: esponse - 


Please open the attached document. This document was digitally sent to you using an HP Digital Sending device. 


-SBU- 
This email is UNCLASSIFIED. 


HRC-/62 


b7E 


ALL el [NPCRV ATION GO aln 
@ HESE IN 1S UR LLEASS uo 
; DATE ll-03-2016 Bi G7esleTs0 NSLlG 


United States Department of State 


Washington, D.C. 20520 


UNCLASSIFED November 2, 2015 


MEMO FOR ASSISTANT SECRETARY GREGORY B. STARR 
FROM: —_ INR—Daniel B. Smith 2S 


SUBJECT: Response to October 29 Letter on the FBI’s Request for the 
Production of Records 


In response to your October 29 memo requesting INR action on the FBI’s 
Request for Production of Records, we have reviewed our records and do.not 
possess an exact duplicate of the intelligence-related materials prepared for the 
Secretary of State from June 16-18, 2011. We have assembled what we believe to 
be a replica of what would have been provided to the Secretary’s staff for those 
days based on our standard operating procedures and a record of the materials 
available for retrieval from those days. (We cannot confirm, however, whether the 
Secretary herself actually viewed this material.) We have those materials available 
for review when requested. 


INR does not have a record of the actual PDB material provided to the 
Secretary for those days and would ask that the FBI seek those records from the 
Office of the Director of National Intelligence. 

We have limited disclosure of this FBI request to a small number of 


individuals in INR who have been instructed not to disclose the existence of this 
request without authorization. 


Attachments: ~ 


Tab 1 — October 29 Letter from A/S Starr 


UNCLASSIFED 


HRC-763 


Approved: INR Daniel B. Smith 


. b7Cc 


HRC- 764 


CLASSIZIEU By: HSlLC CoGWwioel 


Pe  =BEASCNH (4 to 
@ DEC LASSI: GN. 12-31-2040 


ATE: LU-e5 2017 


OrriciaL Recorp 


ment participants have digitally signed, 


FD-1057 (Rev. 5-8-10) dy sae. 
FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


Title: (U//AP@¥e0. Request for AD Concurrence for Date: 11/18/2015 
OCONUS Travel 


ALL INFORMATION CONTAINED 
BEREIN [5 UNCLASSIFIED EXCEPT 


b7c 


From: WASHINGTON FIELD 
CI-Branch 2 


contact: [oO 


SC KABLE CHARLES H IV 
AD COLEMAN RANDALL C 


b6 


case 1D #:[ «iE MA (SPAR). (YPOYEAR EXAM; ae 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U//#e8e) To request AD concurrence for two WFO Special 
Agents to travel to Madrid, Spain, and Manama, Bahrain, to conduct 
interviews. ‘ 

Re 


Derived 
NSISC-200 


Full Investigation Initiated: 07/10/2015 


Details: 


TSC AP) Washington Field Office (WFO) Special Agents (sa)[ | bé 


[Do anaf J respectfully request concurrence for : Be 


travel to Madrid, Spain, and Manama, Bahrain, to conduct interviews 
with two separate individuals related to the captioned prohibited 


HRC-765 


SESRET/ /NOFERIT 
Title: (U/ / Fes} Request for AD Concurrence for OCONUS Travel 
Re: Ld) 11/18/2015 


investigation. Both interviewees have confirmed their availability and 
willingness to participate in the proposed FBI interviews. 
International Operations Division (I0D), Legat Madrid, and Legat Doha 
were notified of the proposed interviews, and have been assisting in 


facilitating the interviews and related travel. 


A request. for Country Clearance (eCC) was submitted on 11/10/2015, and 
approved for Bahrain on 11/12/2015 and Spain on 11/16/2015. 


‘The. following is the proposed travel itinerary for sal __| and SA 


Ld 


11/18/2017 


12:22pm - Depart Washington, DC (DCA) on American Airlines (AA) Flight 
4091 to New York (JFK) 


5:35pm - Depart JFK on AA Flight 8644 to Madrid, Spain (MAD) 
11/19/2015 

6:40am - Arrive in Madrid, Spain 

11/20/2015 

2:00pm - Conduct Interview #1 

11/21/2015 


9:30am - Depart MAD on Etihad Flight-76 to Abu Dhabi International 
(AUH) 


9:35pm - Depart AUH on Etihad Flight 377 to Manama, Bahrain (BAH) 
10:00pm - Arrive in Manama, Bahrain 


SECRET//NORORN 


2 


HRC-766 


b3 
b7E 


bi 
b3 


b6 
b7C¢ 


© & 
SECREL/ /NOFORI 


Title: (U//BFe8e) Request for AD Concurrence for OCONUS Travel 


b3 


11/23/2015 

2:30pm - Conduct Interview #2 

11/24/2015 

12:05am -. Depart BAH on United Flight 8750 to Frankfurt, Coen (FRA) 
11:25am - Depart FRA for Washington, DC (IAD) via United Flight 988 


2:40pm - Arrive in Washington, DC 


o¢ 


_SBERET//3OFORN 


HRC-76/ 


b6 
b7c 


HRC-770 


DATE OF DOCUMENT: 
DATE RECEIVED: 


FROM: 


TO: 
MAIL TYPE: 


SUBJECT: 


DATE ASSIGNED 
11/18/2015 


INFO COMPONENT: 


COMMENTS: 


FILE CODE:. 


EXECSEC POC: 


ALL FEL INPCRMATION GON aAln 
& HEREIN IS UNLLASS L 
UATE ll-OGo-2016 BY GFeJleleo NSIC 


Department of Justice 
EXECUTIVE SECRETARIAT 
~ CONTROL SHEET 
10/28/2015 WORKFLOW ID: 3149177 


11/18/2015 DUEDATE: 12/3/2015 


The Honorable Ron Desantis* 
U.S. House of Representatives 
Washington, DC 20515 


AG 
Congressional Priority 


(Rec'd from OLA via email) Advising that the FBI is conducting an investigation 
into former Secretary of State Hillary Rodham Clinton's use of a private, 
unsecured, email server to conduct official government business and whether 
Clinton's use of this server violated laws pertaining to federal records and the 
transmission of classified information. Stating that a Special Counsel should be 
appointed in order to preserve the integrity of this investigation and any 
subsequent prosecution to ensure there is no bias or undue influence from the 
White House. Letter signed by 55 other MCs. See related corres in ES. 


ACTION COMPONENT & ACTION REQUESTED 
OLA 


For appropriate handling. Advise ES of any action taken. 


OAG, OA ODAG, CRM, FBI, NSD, OIP b6 
qd , fas 

11/18/2015: Per of assign to OLA for appropriate 

handling. 


ExecSec date/time stamp 11/18/2015 7:20AM 


tt 
b7C 
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Co - _ 


ena sn ewe me ow awenus ans ny)6=Sr PB TORT TIN CONTAINED 
© HESEIN [5 UNCLASSIP LED 


DATE 11-03-2016 BY J fecle7s0 NSIlcG 


Congress of the United States 
Washington, BC 20515 


October 28, 2015 


The Honorable Loretta E. Lynch 
Attorney General 

United States Department of Justice 
950 Pennsylvania Avenue, NW 
Washington, DC 20530 


Dear Attorney General Lynch, 


The Federal Bureau of Investigation (FBI) is currently conducting an investigation into former 
Secretary of State Hillary Rodham Clinton’s use of a private, unsecured, e-mail server to conduct 
official government business and whether Clinton’s use of this sever violated laws pertaining to 
federal records and the transmission of classified information. That Secretary Clinton reportedly 
used this server to both send and-receive information classified at the Top Secret level, and that 
members of the military and intelligence communities have been — and continue to be — 
prosecuted for infractions arguably much less egregious, make it of the utmost importance that 
the FBI’s findings are considered by the Department of Justice in a politically impartial manner. 


Unfortunately, during a CBS interview on October 11, 2015, President Barack Obama 
commented on the ongoing investigation into Secretary Clinton’s server, declaring that: “I don’t 
think it posed a national security problem.” Given that the FBI has not finished its investigation 
regarding the use of Secretary Clinton’s server, the President prejudged the outcome of the 
investigation. Needless to say, this is not the way that a politically impartial investigation should 
be conducted. — 


Under Department of Justice regulations, you have the grounds to appoint a Special Counsel 
when it is determined that criminal investigation of a person is warranted and that the 
investigation of that person “by a United States Attorney's Office or litigating Division of the 
Department of Justice would present a conflict of interest for the Department or other 
extraordinary circumstances.” 


At this point, a Special Counsel must be appointed in order to preserve the integrity of this 
investigation and any subsequent prosecution and ensure that there is no bias or undue influence 
from the White House. It is not within the purview of the President to conclude, much less 
without a full investigation, that classified information carelessly transmitted over an improperly 
secured connection did not pose a risk to our national security. 
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As Attorney General, you are trusted by the American people to pursue justice regardless of 
political considerations. Under the extraordinary circumstances established by the President’s 
recent remarks, we ask that you appoint a Special Counsel to oversee this critical investigation. 


Sincerely, 


HRC-773 


HRC-774 


HRC-775 


HRC-776 | 


ae ce 


HRC-777 


nd sentinee aclabneciseioncsetaeees 


Pee aenaten ees 
fseneenemacens See 


1. Ron DeSantis (FL-6) 32. Kevin Cramer (ND At-Large) 
2. Trent Franks (AZ- 8) 33. Ryan Zinke (MT At-Large) 
3. Matt Salmon (AZ-5) 34. Bill Flores (TX-17) 

4, Steve King (1A-4) 35. Michael Burgess (TX-26) 
5. John Fleming (LA-4) 36. Jim Jordan (OH-4) 

6. Andy Harris(MD-1l) 37, Louie Gohmert (TX-1) 

7. Raul Labrador (ID-1) 38. Brian Babin (TX-36) 

8. Mark Meadows (NC-11) 39. Jim Bridenstine (OK-1) 

9. Paul Gosar (AZ-4) 40. Ted Yoho (FL-3) 

10. Randy Weber (TX-4) 41. Mike Conaway (TX-11) 
11. Doug LaMalfa (CA-1) 42. Tim Huelskamp (KS-1) 

12. Thomas Massie (KY- 4) 43. Trent Kelly (MS-1) 

13. Mick Mulvaney (SC-5) 44. Jeb Hensarling (TX-5) . 


14. Gary Palmer (AL-6) 

15. David Schweikert (AZ-6) 
16. Justin Amash (MI-3) 

17. Jeff Duncan (SC-3) 

18. Marshall “Mark” Sanford (SC-1) 
19. Dana Rohrabacher (CA-48) 
20. Marlin Stutzman (IN-3) 

21. Tom Rice (SC-7) 

22. Mark Walker (NC-6) 

23. Thomas Rooney (FL-17) 
24. Bill Posey (FL-8) 

25. Scott Perry (PA-4) 

26. John Ratcliffe (TX-4) 

27. David Brat (VA-7) 

28. David Rouzer (NC-7) 

29. Barry Loudermilk (GA-11) 
30. Morgan Griffith (VA-9) 
31. Walter Jones Jr. (NC-3) 
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; SLL Ee. NECRS ATION CONTAINED 
HEREIN IS UN CLASS oo 
DATE Tl-Os-2016 By g76/leTe0 HSIcG 


FromL_____ oa) Be 


Sent: Tuesday, November 17, 2015 3:37:36 PM ue 


To: MD 
CC JMD) 
Subject: FW: Letter from Congressman Ron DeSantis 


Pee te wy eT 


Pls log the attached & assign to O for appropriate handling. Thanks. bé 
b7C 

Fromi_____OLA) | 

Sent: ber 17, 2015 3:33 PM b6 

To OLA) b7c 

Cc LA) 


Subject: FW: Letter from Congressman Ron DeSantis 


=| bé 
Can you enter into Exec Sec and then assign to OLA? (eee a il b7c 
We will draft and response and circulate to NSD, FBI, ODAG as appropriate. 


Many thanks - 


jo) re | bb 

Sent: Tuesday, November 17, 2015 10:39 AM b7c 

To OLA) © , 

Cc (OLA) : 
Subject: FW: Letter from Congressman Ron DeSantis 


b7c 
is this one in your portfolio? Please advise. Thanks! 


b6 per FBI, OLA 
b7C per FBI 


Subject: Letter from Congressman Ron DeSantis . 


Good Morning b6 


b7C 
Attached is a letter for your consideration. Please review and advise. 
Respectfully, 
Congressman Ron DeSantis b6 per FBI, OLA 
308 Cannon House Office Building {i} http://DeSantis. House.Gov b7C per FBI 
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ALL Zel INZORMATION CONTAINED 
wo ----"HEREIN IS JUCLASS a 
HSTE 11-09-2016 BY g76JleTel NsluG 


LAW OFFICES 


WILLIAMS & CONNOLLY LLP 
725 TWELFTH STREET, N.W. 


DAVID E. KENDALL WASHINGTON, D. C. 20005-5901 EDWARD BENNETT WILLIAMS (920-1988) 
‘ u PAUL R. CONNOLLY (1922-1978) 
Pasian (202) 434-5000 


FAX (202) 434-5029 


‘ December 7, 2015 
BY E-MAIL 


= — 5 =) | . BIG 


National Security Division 
905 Pennsylvania Avenue NW 
Washington, DC 20530 


Deal bé 
b7C 
As memorialized in our prior correspondence, former Secretary Clinton has provided 
consent to search certain of her files for evidence relevant to your security inquiry. That consent 


applies to her files dated January 21, 2009 to February 1, 2013 and located on specified devices, 
server equipment, and backup files that have been provided to the Department of Justice for this 


_ purpose. 


This letter will confirm that the consent to search her files for evidence related to your 
security inquiry applies to files on those specified devices, server equipment, and backup files 
that are dated January 21, 2009 to February 1, 2013 and were sent or received from the 
hr1 5@mycingular. blackberry.net or hr1 5@att.blackberry.net accounts. In confirming this 
consent, we hote that it applies solely to the above-described files of Secretary Clinton, and not 
to the files of any other individuals. 


In connection with this confirmation of consent to search for evidence related to your 
security inquiry with respect to these two accounts, I incorporate by reference my October 1, 
2015 letter, which provides a list of individuals and entities with whom Secretary Clinton may 
have communicated in a privileged context, and my October 16, 2015 e-mail, which 
supplemented that list. 


We request and anticipate that at the conclusion of your inquiry you will return to us 
Secretary Clinton’s non-federal record e-mails. 


David E. Kendall - 


HRC-781 


b3 
[_____tie > 


HRC-782 


pS pit + ede @ ' ALL FBI INFORMATION CONTAINED 


DAVID E. KENDALL — 
(202) 434-5145 


HEREIN [5 UNCLASS IV IED 
UATE 11-03-2016 Br g/eulsTeo NeICG 


LAW OFFICES 
WILLIAMS 8 CONNOLLY LLP 
725 TWELFTH STREET, N.W. 
WASHINGTON, D. Cc. 20005-5901 EDWARD BENNETT WILLIAMS U920-1988) 
PAUL R.. CONNOLLY 0922-1978) 
(202) 434-5000 


ac is FAX (202) 434-5029 
December 11, 2015 
BY E-MAIL 
b6 
U.S. Department of Justice b7C 
National Security Division 
905 Pennsylvania Avenue NW 
Washington, DC 20530 
Deat__ bs 
b7C 


Enclosed please find documents stamped HC-001 — HC-054, which are responsive to 
your requests. We note that former President Clinton’s counsel has no objection to the 
production of these documents. 


Sincerely, 


Dorid & Pao 


David E. Kendall 
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Vendor QuickReport 


All Transactions 


Payment Type Financial Institution | Debit | 


03/30/2009) JP Morgan 
05/28/2009] JP Morgan 
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Wire 06/07/2011) JP Morgan 


06/17/2011| JP Morgan 
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Check 02/01/2013; JP Morgan 
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Check 07/12/2013] JP Morgan 
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HRC- 784 


INVOICE 


Date:, 2011 


For: 
Justin Cooper Tech labor 
Please make payable to Bryan Pagliano 


DESCRIPTION _ 


Onsite work plus expenses 
Check botnet filter, virtualization and IPS monitoring 


Canfigure VPN, configure 2 factor, update Ips Image and signatures 
Configure IPS in logging mode 


HC-002 
af 2 5 8 ets cs : ; HRC-785 


CLINTON EXECUTIVE SERVICE CORP. 


Sa 
” 


7 PAY 
TO THE 


ORDER OF Bryan Pagiiano e 


’ Two Thousand Five Hundred and 00/10( 


[ — 


MEMO 


CLINTON EXECUTIVE SERVICE CORP. 


Bryan Pagliano 
Expenses:IT Services 


CESC - JPM BillPay — Inv Dtd:10/15/ 
CLINTON EXECUTIVE SERVICE CORP. 


’ Bryan Pagliano 
Expenses:|T Services 


CESC - JPM Bill Pay 


PRODUCT DI 1104 
204 


‘USE WITH 91883 ENVELOPE 


Inv Dtd:40/18/12 = Tech Labor 


Inv Dtd: 10/15/12 - Tech Labor 


— — Mw 
5102 
J. PMorgan 
JPMorgan Chase Bank, NAL 
Naw York: Naw Yc fark 
-12-210- 40/22/2012 . j 
Me : 5 
fa a 
$ **2,500:00. 2 8 
é 
Lopisretnseeveserecsnnannnneevasenuteensesiiépninanneesnnttnusnneeas | DOLLARS Fs 
= 
g 
 & 
‘bé | 
b7c 
ope. 
b7c 
5102 
10/22/2012 
Inv Dtd:10/15/12 - Tech Labor 2,500.00 
42 - Tech Labor 2,500.00 
. 5102 
40/22/2012 
Inv Dtd: 10/15/12 - Tech Labor 2,500.00 
2,500.00 
PRINTED IN uae A 
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INVOICE 


Date;Oct 15, 2012 


To: For: 
Justin Cooper Tech labor 
Please make payable to Bryan Pagliano 


~~ Install service pack for BES and push security 
policies for ipad 8/15 


af sito an a 
al fratoxere el 


Replace Data in different location fof mailbox 
8/20 


Install service packs, apply exhange server hotfix bs | 
8/3 


1of1 


b6 
b7C 


b6 
b7Cc 


b6 
b7C 


HC-004 


HRC-78/ 


Dy 


: 


= CLINTON 


PAY TO THE - Bryan Pagliano . 
ORDER OF . 


a 


; MEMO _ Tech Labor. 


CLINTON 
Bryan Pagliano 
Personal Expenses:|T Expense Tech Labor 


JPM-Bill Pay-3661-20 Tech Labor 


CLINTON 
Bryan Pagliano 
Personal Expenses:IT Expense Tech Labor 


JPM-Bill Pay-3661-20 Tech Labor 


B)pewuxe con’ 1+800-328-0304 www.deluxeforms.com 


_SPMORGAN CHASE BANK, N.A. 
. NEW YORK, NEW YORK 
_, 12-210 


Two Thousand: Eight Hundred Twelve ae 50/1 Ogsseeeeesisessessennecentetenneenensevrataonsesenenennniensitonesiatins 


i 

, i 
$ 2,812.50 3 

tl 

i 


" ansreor2 . 


DOLLARS 


- 
b7Cc 


4/13/2012 


4113/2012 


b6 
b7Cc 


2455 


2,812.50 


2,812.50 


2455 


2,812.50 © 


2,812.50 


Hec- 005 
HRC-788 


INVOICE | 


b6 
b7C¢ 


Date:April 10, 2012 


To: For: 
Justin Cooper Tech labor 
Please make payable to Bryan Pagliano 


VPN and SSL cert San, . $125 $187.50 
ae Bae! : Pe Cs Saree 


fix symantec av updating Issue aaa $125 | 


Drive ordering, fix ven, tune IPS ee oe _ $500 


Dynamic IP blocking 2 aaa $250 
Troubleshoot blackberry and install forefront 2010 aa $425 $500 


EUS a: Se 
HRC-789 


’ 


! 

J.PMor gan i 

JPMergan Chase bank, WA. ime anee i 

Now York, Nov t 

CLINTON 13-210 t 
2/1/2013 i 
5 
PAY TO THE nee j 
ORDEROF —_ Bryan Pagliano $ 3,187.50 4 
Three Thousand One Hundred Eighty-Seven and S0/100*******sserenesrets oust sensnenesorsvassntatonneneneerastnarenirs DOLLARS | 


b6 
b7c 
i 


MEMO | 
Tech Labor : 1 
b6 
b7c 
CLINTON 3172 
Bryan Pagliano 2/1/2013 
Personal Expenses:!T Expense Tech Labor 3,187.50 
JPM-Bill Pay-3661-20 Tech Labar 3,187.50 
CLINTON | 3172 
Bryan Pagliano 2/1/2013 
Personal Expenses:IT Expense Tech Labor 3,187.50 
J 
JPM-Bill Pay-3661-20 Tech Labor 3,187.50 
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_ 3 , . @ HC-007 
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Bryan Pagliano INVOICE 


b6 
b7C¢ 


~ Date-Oct 15, 2012 


For: 
Tech labor 
Please make payable to Bryan Pagllano 


Troubleshoot BlackBerry Issues 10/24 


Total ; 


HC-008 
. a = Be HRC-791 


JPMorgan 


JPMorgan Chase B Bank, NA. Cinna 
CLINTON 1-2-210 
| 5/2/2013. { 
§ 
PAYTOTHE ryan Paglano : $ 181250 ° 
One Thousand Eight Hundred Twelve and §0/1 DOTA terraesenaeeenetenenstenserasnrantenateusmnaweionscatouvenneseineene . DOLLARS j 


Pagliano , 
a 
b6 


’ 


MEMO 


Tech Labor 


b7C 
CLINTON 3393 
Bryan Pagliano . §/2/2013 
CESC Expenses: IT Plan Tech Labor 1,812.50 
JPM-Bill Pay-3661-20 Tech Labor 1,812.50 
CLINTON . 3393 
Bryan Pagliano 4 5/2/2013 
CESC Expenses: IT Plan Tech Labor 1,812.50 
JPM-Bill Pay-3661-20 Tech Labor 1,812.50 


PRODUCT DLT 06 ‘USE WITH 91663 ENVELOPE 


a | , @ HC-009 
-ARC-792 


. 4 F ] - and a 
Bryan Pagliano IN VOTE 
bé6 
b7C 
Date:Jan, 2013 
For: 
Tech labor bé 
Please make payable to Bryan Pagliano b7C 
b6 
Call with Cheryl and__}/11 | $125 bic 
Call with cheryl FY and document review 4/15 1.5 | 82s | $187.50 
Emails tq and data collection for] about tech details $125 
a 


HC-010 
HRC-793 


J.PMorgan 


tr Noon aes 
ow 
CLINTON 1-2-210 
7442/2013 | 
PAY TO THE 
ORDEROF Bryan Pagliano $068.75 ° 
Nine Hundred Sixty-Eight and 75 OO*A era tseasennrnessansessssasessondavavanennaressenanenweranresssasevonseoaneessena DOLLARS e 
& 
b6 
b7c 


MEMO 


Tech Labor 


CLINTON 


JPM-Bill Pay-3661-20 Tech Labor 


Bryan Pagliano 
CESC Expenses:IT Project 


CLINTON 


CESC Expenses:IT Project 


JPM-Bill Pay-3661-20 Tech Labor 


PRODUCT OLTIO4 


Bryan Pagliano 


USE WITH 91669 ENVELOPE 


Tech Labor 


Tech Labor 


7112/2013 


714212013 


968,75 


3598 


968.75 


Bryan Pagliano 


Date:July.10, 2013 


For: 
Tech labor 
Please make payable to Bryan Pagliano 


DESCRIPTION 
Troubleshoot message delivery failure and respand to emails L5 


Cloud Jacket Demo meeting 5/8/13 
Check server for guugluunts! pissin Wlintupcor 5/13/2013 


‘| Conference call wi 5s 6/3/2033 
| Conference call wit 4/2013 75 


Emails to Platte Team 6/5/2013 t 


$125 $93.75 


bad 
_— 
Nn 
wm 


HC-012 


b6 
b7C 


b6 
b7C 


b6 
b7C 


. , HRC-795 


Bryan Pagliano INVOICE 


b6 
b7C 
Date:Jan 9, 2011 
For: 
Justin Cooper Tech labor 

Please make payable to Bryan Pagliano 

DESCRIPTION 

DNS and server slowness issue troubleshooting 
7 


HC-013 
2 ie _ HRC-796 


Bryan Pagliano | INVOICE 


b6 
b7c 
For: 
Tech labor 
Please make payable to Bryan Pagliano 
DESCRIPTION 
"1/28/2011 Blocked ip, changed username for justin, wrote BES IT policy and 
worked on quote witi[__] b6 
2/12/2011 Responded to emails, preped for Blackberry upgrad, blocked ips at b7C 
firewall. : 
2/17/2011 Blackberry security policy, quotes with} = [| 
2/19/2011 Upgrade Blackberry server : 
3/06/2011 2 firewall blocks 
Pe eee we ce ee : 


HC-014 
. HRC-797 


From: "Bryan M. Pagiano| 9 _ bE 
Subject: Re: So it looks lik b7c 
Date: April 24, 2011.10:50:59 PM EDT 
To: Justin Coope 


wee = we ee aos ‘ : 5 eee ie. * 


Total is $264.92 with 2 day shipping and rush order processing. 


.-Bryan 

On. Sun, Apr 24, 2011 at 9:59 PM, Bryan Pagan ive: b6 
‘No problemo, I'll let you know the total. : b7c 
{-Brvan 


1 


-On Sun, Apr 24, 2011 at 9:51 PM, Justin - b6 
i | If you do not mind -- easier if you put on yours and 1 can send a check out to you tomorrow morning b7C 
i , On Apr 24, 2011, at 9:29 PM, Bryan Pagliano wrote: 


"We do need to buy another switch that can do jumbo frames and vlans. I looked through all the unmanaged dell switches and they don't 
4 do jumbo frames, 


. Found a nice little cisco that will work for about $230. 
Do you have a credit card that you can use to buy it and ship it to me? If not, I can just put it on my card and bill you for it later. 


- Here is the link: 


216833150087 
, i Ifyou could 2 day ship it, I scheduled with my Cisco friend to hang out this week and take a look at things. 


' ; -~Bryan 


HC-015 
HRC-798 


From: "Bryan M. Pagland| arto 
Subject: Fwd: Total cost $338.39 - Order Confirmation 
Date: April 30, 20112:28: 
Te: dustin Goopef 


From: Neweag <into@mewswmcom> 
Date: Sat, Ape 30, 2011 ot 236 PM 


ject Ni »,com + Order Confimnation 
qe : 


Newegg logo 


y 


j 


lick to browse e-Biast 


Ooer Bryan Mi Pagliano, 


“Hick to browse Shell Shecker 


10 
b6é 


b7Cc 


b6é 
b7C 


| : os ; 
Twitter “YouTube |‘ Facebook | , Myspace 


tick ta browse Daily Deals 


Account Num 
b7C 


Thank you for shopping at Newegg.com 


We're delighted we had what you were looking fort 


Your order should be processed and ready to be shipped within 24-48 hours. Below Is your order 
confirmation. Please keep a copy for your records. 


Please click here to check order status. 


Order Summary: 


Sales Order Number: 78908157 


Sales Order Date: 


Billing Information vk. : 


4/30/2011 11:35:17 AM 


b6 
b7C 
Shinping Information ; 
La 
b6 
b7C 
1 x (6309.99) UPS BATTERY APGIREC24 RT $309.99 


Payment Term: Mastercard 
Extended Warranty: $0.00 


Subtotal: $309.99 
Tax: $0.00 


Shipping and Handilng: $26.40 


Totai Amount: $336.39 


To view our Return Policies, please click here. Newegg.com reserves the right, in its sole discretion, 
to cancel the order at any time prior to shipment without Ilabiilty, 


To view more recommendations, please click here. 


If you have any questions, please use our LiveChat function or visit our Contact Us Page. 


Once You Know, You Neweqq.® 


HC-016 
HRC-799 . 


11 
From: "Bryan M. Pagiand_____| b6 
Subject: Fwd: Newegg.com - Rush Order Confirmation b7c 
Date: June 6, 2017 1:41: 
To: Justin Coope 
‘Total ts $610,72 
-Bryan 
weccececee Korvarded message ---------- 
Krom: Newegg <ijnfo@newerr.com> 
Date: Mon, Jun 6, 2011 at 1:40 PM 
Subject: Newegg.com - Rush Order Confirmation 
a b6 
b7c 
Newegg logo { , . My Account | Customer Sarvicas 
Twitter ‘ ‘YouTube . | Facebook Myspace 


Blick to browse 


Electronics Cameras Software Gaming 


e-Blast click to browse Sheli Shocker | Klick to browse Daily Deals 


MarketPlace Outlet More: 


Customer ID 


b6 
Seo evan TA Pash wie. 5 haarmame| —| b7c 


Thank you for shopping at Newegg.com. 


We appreciate your confidence and your business! 


We will attempt to rush this order for same day shipping, as you've requested and paid for, provided 


that the following conditons are met: 


1. Your order is submitted before 12:00PM PT (noon) 


2. Your transaction and credit card authorization is successfully completed before 12:30PM PT. 


3. Your shipping address matches your credit card billing address. 


Disclaimer: — 


IN ALL CIRCUMSTANCES, Newegg's MAXIMUM LIABILITY 1S LIMITED TO THIS RUSH ORDER FEE 
ONLY. WHILE NEWEGG CANNOT GUARANTEE SAME DAY SHIPMENT FOR ALL ORDERS, WE WILL PUT 
FORTH OUR BEST EFFORT TO SHIP THIS ORDER ON 6/6/2011, OR YOUR RUSH ORDER 


PROCESSING FEE WILL BE REFUNDED. 
Below Is your order confirmation. Please keep a copy for your records. 
Piease click here to check Order Status. 


Order Summary: 


Sales Order Number: 80741957 

Sates Order Date: 6/6/2011 10:39:16 AM 

Billing Information a | Shippirig Information 
Bryan M Pagliano Bryan M Pagliano 


b6 
b7C 


HC-017 
HRC-800 


11 

Item List: ; 
1x 99 P' AL X413 RT $499.99 
Payment Summary: _ rae Snel ee Ser ate 
Payment Term: Mastercard 
Extended Warranty: $0.00 
Subtotal: $499.99 
Tax: $0.00 
Shipping and Handling: . $107.74 
Rush Order: $2.99 
Total Amount: ; ' $610.72 
If you have any questions, please use our LiveChat function or visit our Contact Us Page. 
Once You Know, You Newegg. 
Your Newegg.com Customer Service Team 

ONCE YOU KNOW, YOU NEWEGG: ® ° - a 

Policy and Agreement | Privacy Policy | Confidentiality Notice 
Newegg.com, 9997 Rose Hills Road, Whittier, CA. 90601-1701 | © 2000-2011 Newegg Inc. All rights reserved, 
HC-018 


. ee HRC-801 


Bryan Pagliano | INVOICE 


b6 
b7C 


Date:June 14, 2011 


For: 
Tech labor 
Please make payable to Bryan Pagliano 


AMOUNT 


$625 


Cisco ASA, and switch configs 4/28/2011 

Iscsi configuration format of NAS, Battery mixup reorder 4/30/2011 
Syslog configuration client side traps 5/4/2011 

ACL configurations on the ASA 5/5/2011 


Pack equipment and tools and drive to NY, Final ASA configs pre implementation 
6/12/2011 


Onsite, Implement new equipment, repair battery, troubleshoot and test 
6/13/2011 


Morning final test, return, unpack, troubleshoot printer and enored: slow email 
6/14/2011 


HC-019 
, _  HRC-802 


COMFORT INN AND SUITES (NY618) rocounl___] b6 
i 20 SAW MILL RIVER RD Date: 06/14/11 b7C 
¢ wile Page: 1 of 1 


HAWTHORNE, NY 10532 USA 
ne CHOICE HOttes Phone: (914f'592-8600 

Fax: (914) 592-7457 
gm.NY618@choicehotels.com 


Room: 221 BAR 
Arrival Date: 06/12/11 21:30 
Departure Date: 06/14/11 09:49 
Frequent Traveler 1D: 


; You were checked out ; b6 
You were checked In b: b7c 
PAGLIANO, BRYAN 
b6 
Post Date Description Comment Amount b7C 
06/12/11 ROOM CHARGE #221 PAGLIANO, BRYAN 160.00 
06/12/11 STATE TAX STATE TAX 11.81 
06/12/11 CITYICOUNTY TAX CITYICOUNTY TAX 4.80 
06/13/11 ROOM CHARGE #221 PAGLIANO, BRYAN 160.00 
06/13/11 STATETAX STATE TAX 11.81 
06/13/14 CITY/COUNTY TAX CITY/COUNTY TAX 4.80 
06/14/11 MASTER CARD as -353.22 
; Balance Due: 0.00 


If payment by credit card, | agree to pay the above total charge amount according to the card issuer agreement. 


(es 


= COMFORT INN AND SUITES (NY618) Room: 221 Approval Number: 
= 20 SAW MILL RIVER RD Arrival Date: 06/12/11 Card Type: MC 
‘ syst ' HAWTHORNE, NY 10532 USA Departure Date: 06/14/11 Date: 6/14/2011 
. : ee a ce 
ev EMOEE MOTELS Phone: (914) 592-8600 Frequent Traveler ID: TourSss aE nae 


Fax: (914) 592-7457 


BRYAN PAGLIANO If payment by credit card, | agree to pay the above total charge amount according to 
the card issuer agreement. ; b6 


b7C 


Thank you for your business! Book your next reservation on choicehotels.com for the best internet rates guaranteed. 


HC-020 
, ; HRC-803 . 


ENTERPRISE RAC COMPANY, 2020 JEFFERSON DAVIS HWY, ARLINGTON, VA 222023601 (703) 418-7240 


RENTAL AGREEMENT REF# 
592120 ORLSPB 
RENTER 


PAGLIANO, BRYAN 


DATE & TIME OUT 
06/12/2011 11:57 AM 
DATE & TIME IN 
06/14/2011 04:34 PM 


BILLING CYCLE 
24-HOUR 


VEH #1 2011 JEEP LBTY SPT4 
VIN# 134PN2GK7BW552009 
LIC# XFR2744 

MILES DRIVEN 296 


6/14/2011 


SUMMARY OF CHARGES 

Charge Description Date. wantity Per Rate Total 

TIME & DISTANCE 06/12 - 06/14 3 DAY $59.99 $179.97 

DW G6/iz- 06/14 3 DAY $17.99 $53.97 

PAL 12 - 06/14 3 DAY 3.00 5.06 

REFUELING CHARGE 06/12 - 06/14 $0.00 

ROADSIDE ASSISTANCE 

PROTECTION ; 06/12 - 06/14 3 DAY $3.99 $11.97 

-Subtotal:. 254.91 

Taxes & Surcharges 

VEHICLE LICENSE 

RECOVERY FEE 06/12- 06/14 3 DAY $0.23 $0.69 

VIRGINIA ADDITIONAL TAX 06/12 - 06/14 4% $10.23 

VIRGINIA RENTAL FEE 06/12 - 06/14 2% $5.11 

VIRGINIA RENTAL TAX O6/ 12 -. Os/ 14 4% $10.22 
Total Charges: $281.16 

Tota! Amount Due $0.00 

PAYMENT INFORMATION 


AMOUNT PAID TYPE BER 
$281.16 Mastercard PENDING 
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SOURTESY. Nog 

280 SAKIIL "RIVER RD 
ELMSFORD Ny 

14s ~592-86i8 


ta eee ee 


bé 
b7c 
Pump p> NY 26 FOROREST GLEN RD 
mp 3 fe) } 
Galfots [ai os SILVER SPRING MD 
PricesGai‘*"s res 9320375 
uel Sale ° 8 57° 9-099 
You Saved $0.100/Ga} 
DATE 06/12/11 16:45 
P 0 
PRODUCT: REGULR 
GALLONS : 13.306 
PRICE/G: $ 3.899 
FUEL SALE $ 51.88 
THANK You Fop r 
CHOOS 1 neu b6 
MOBIL b7c 


Reap Code: 
Stan: 019083334 


SITE ID: 9320375 
Earn a 5% rebate 
vith the BP Visa 


Take application 
and Apply Today 


THANK YOU 
HAVE A NICE Day 


= 
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aval Pagliano | | I NVOICE | 


~ Date:, 2011 


To: For: 
Justin Cooper Tech labor 


Piease make payable to Bryan Pagliano 


DESCRIPTION 


Troubleshoot and turn off esmtp inspect, install virus protection on syslog server 
6/15/2011 


Install solarwinds log forwarder, troubleshoot symantec install, configure syslog 
for firewall and servers, block a bfa manually 6/21/2011 


ASA configurations, scanning filter, botnet filter, spoofing filte, sbsmonacct 
troubleshooting 


Take Screen shots for gui block of Brute force attack 7/18/2011 


eked ip’s, patch blackberry server with microsoft patches, look through $125 $187.50 


Reset password and block bfa 8/1/2011 


Check software version of BES server and download patches, research 2 factor 
solutions 8/9/2011 


al 
coon dT 
F UplsteaHorasconeesenmamn 
[Bckatranainsad ieee ontease enemon tL | 
configure tomer tte gaterirecos arava 

_ Pushed new security policy tq —_]VPN configuration planning 


Applied security policy t? —_‘[BB, configured self signed cert on asa. 
8/25/2011 : 
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Vendor QuickReport 
All Transactions 


| — me ee ee ee Financial institution | Debit as 


lusz21, INC. 
— 03/03/2009 5,155.00 

03/30/2009) JP Morgan ____ 921.00 

03/26/2010] JP Morgan 160.00 
01/21/2011/JP Morgan 3,957.00 
03/02/2011| JP Morgan 
03/02/2011) JP Morgan 
08/02/2011; JP Morgan 
Credit Card Charge 02/12/2012! JP Morgan 


Check 05/21/2012| JP Morgan . 
Check 01/31/2014) JP Morgan 


| fro EP 000 29506. 95 
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QUOTATION 


Quote Number: CLIN-0224 
Quote Date: Feb 24, 2011 


2721 Prosperity Ave. Suite 300 Page: 1 
FAIRFAX, VA 22031 


Voice: 703 560-0021 
Fax: 703-560-2336 


oe i mn io mg ESE Day Ep iter aT ES re 
Net 30 Days bé6 
b7C 


“7.00 AND-PGO-PK | MNT PK DEF ANDRO eat 
TOKEN LICS 


1.00 | DWB-PGO-PK DEFENDER/BLACKBERRY TOKEN PACK 75.00; 75.00! 
LIC/MNTPK : 


‘| Ethemet - with Cisco Advanced Inspection 


: and Prevention Security Services Module 
10 (AIP-SSM-10) 


t 


i 


4.00 | ASA5510-AIP10-K9 ! Cisco ASA 5510 Security appliance - Fast 3,680.00 3,680.00 
1 


1.00 | NSS324D04-K9 Cisco Small Business NSS 324 Smart 4,580.00 | 
i Storage NAS - 4 TB - Serial ATA-300 - HD 
1TBx4-RAIDO, 1, 5,6, JBOD, 5 hot 
spare - Gigabit Ethemet - iSCSI 
1.00 | P73-04982 Microsoft Windows Server 2008 R2 692.00 
t Standard License - 1 server - Open 
| Business. 


1.00 | 300052052 SolarWinds - KIW| SYSLOG SVR SGL 290.00.i 


INST LIC W/ 12MO MNT 
| 


1.00 | FREIGHT Shipping and Insurance 57.00 


6,449.00 


Subtotal | 
ae Ter 
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2721 Prosperity Ave 


Suite 300 
US21 Fairfax, VA 22031 Invoice ti 6164 


Phone # 703-560-0021 


Cc Sy Usths ne Invoice 


Fax # 703-560-2336 Date: 3/30/2012 
WILLIAM | CLINTON WILLIAM CLINTON 
b6 
b7c 
b6 
b7c 
20 SFO. 0058 36 ; Microsoft ~OV FORERNT ‘PROT EXCH SVR SNGL, | 
36M AP PER U. | 
. : William Clinton : 
: Attn: Justin Cooper ’ 
b7c 


| b6 


‘License Authorization Number 


License Agreement Number 


ae ee ET Oo 8 
i  * 


| i 
en . ce be | 

, Subtotal USD | . $880.00 
Notes Tax $0.00 | 

[_ acne 


SBB0. 00 


Total 
Payments/Credits $0.00  galance Due | $880, ry |@ 
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2721 Prosperity Ave 


Suite 300 
US21 rairfon, VA 22031 Invoice # 10210. 


Phone # 703-560-0021 
Fax # 703-560-2336 . Date: 3/12/2013: 


eS US21, Inc. Invoice 


Rian Eee 


EAM een 


SEN OEE ‘, Rapa j 
eran Maes ey tise. eon 


JUSTIN COOPER 


Bis ay 


teicher 


ISAS EAaipene on acres E aoe 
JUSTIN COOPER 
ee BS eee aur ae AHO TEE poate 
3/12/2013 3/12/2013 
EVE RE SP UDIRE ce ar ee EN Pile 
Tout of Warranty On-Site Service Incident - 249,00 
Desktop, Workstation and Notebook 


tae 


= 900- 0006 
} 


1! 900-0009 “Parts Required on an Out of Warranty Call i 69.95 | 69.95 
I PART #NU209 : 
IF SRTAG #G6842PC1 


Service address is 


a 


1] L-ASASS10-BOT-1y R= ‘Cisco ASA $500 Botnet Traffic Filter License 420.00 420.00 
Subscription Ilcense { 1 year) - 1 appliance - 
delivered via electronic distribution 


Product Number 
ASAS510-AIP10-K9 


Service Product Number 


CON-SU1-AS1A10K9 


Serial Number 
| JMX1421L089 


; \ 
a Eo | 
Subtotal USD $738.95 
Notes Tax 
Total _ $738.95 
Payments/Credits $0.00 Balance Due $738.95 
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INTUITION 


Service Level Agreement (SLA Premium) 
for CESC 


by 
Platte River Networks 


Lifective Date: 7/_/2013 


Document Owner: Platte River Networks 


Version 


Verion [Dae] 
Ge ee 


[PRN sd 


Approval 


(By signing below, ail Approvers agree to all terms and conditions outlined in this Agreement.) — 


Platte River Service Provider / (2013 
Networks ta 


CESC 
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1. Agreement Overview 


3. 


This Agreement represents a Service Level Agreement (“SLA” or “Agreement”) between 
Platte River Networks and CESC for the provisioning of IT services required to support and 
sustain through the Intuition Premium package. (As Outlined Below) 


This Agreement remains valid until superseded by a revised agreement mutually endorsed by 
the stakeholders. 

This Agreement outlines the parameters of all IT services covered as they are mutually 
understood by the primary stakeholders. This Agreement does not supersede current 
processes and procedures unless explicitly stated herein. ots ey 


Goals & Objectives 


The purpose of this Agreement is to ensure that the proper elements and commitments are in 
place to provide consistent IT service support and delivery to the Customer(s) by the Service 
Provider(s). 


The goal of this Agreement is to obtain mutual agreement for IT service provision between 
the Service Provider(s) and Customer(s). 


The objectives of this Agreement are to: 


» Provide clear reference to service ownership, accountability, roles and/or 


responsibilities. 
« Present aclear, concise and measurable description of service provision to the 
customer. 
¢ Match perceptions of expected service provision with actual service support & 
delivery. 
Stakeholders 


The following Service Provider(s) and Customer(s) will be used as the basis of the 
Agreement and represent the primary stakcholders associated with this SLA: 


IT Service Provider(s): Platte River Networks 
IT Customer(s): CESC (“Customer”) 
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4, Periodic Review 


a 


This Agreement is valid from the Effective Date outlined herein and is valid until further 
notice. This Agreement should be reviewed at a minimum once pet fiscal year; however, in 
lieu of a review during any period specified, the current Agreement will remain in effect. 


The Business Relationship Manager (Platte River Networks) is responsible for facilitating 
regular reviews of this document. Contents of this document may be amended as required, 
provided mutual agreement is obtained from the primary stakeholders and communicated to 
all affected parties. The Document Owner will incorporate all subsequent revisions and 
obtain mutual agreements / approvals as required. 


Business Relationship Manager: Platte River Networks 
Review Period: Quarterly 
Next Review Date: 10/15/2013 


Service Agreement 


The following detailed service parameters are the responsibility of the Service Provider in the 
ongoing support of this Agreement. 


5.1. Service Scope 
The following Services are covered by this Agreement*; 


Monitoring 

Reporting 

Alert Management 

Maintenance 

Threat Protection 

Email Continuity 

Web Filtering 

Workstation Management 

Helpdesk Services ~ Level I, II, MII Support 
Troubleshoot & Fix Server, Infrastructure Including Workstations 
Monthly Recurring Charge 

Initial Setup Fee Required 

Initial On-boarding process will take up to 30 days 


eoooooocoooo0o0d 30 


* Consulting Services Billed Time & Materials for Hardware failures, Disaster 
Recovery, Projects. 


* Platte River Networks reserves the cight to include ‘out of scope’ work within the scope of this 
agreement. 


47 
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INTUITION 
5.2, Customer Requirements 


Customer responsibilities and/or requirements in support of this Agreement include: 


e Payment for all support costs at the agreed interval. 

© Reasonable availability of customer representative(s) when resolving a service 
related incident or request. 

© Client is asked to notify Platte River Networks of any/all changes to their network 
environment at least 30 days prior to the change takes place including all: office 
location, hardware, software, telecom/circuit, printing/copying/scanning, and 
website/DNS. 


5.3. Service Provider Requirements 


Service Provider responsibilities and/or requirements in support of this Agreement 
include: 


© Meeting response times associated with service related incidents. 
© Appropriate notification to Customer for all scheduled maintenance. 


5.4, Service Assumptions 


Assumptions related to in-scope services and/or components include: 
e Changes to services will be communicated and documented to all stakeholders. 
e The number of Servers, Workstations and/or network devices monitored by 
Intuition may be modified from time to time by the mutual agreement of both 
PRN and Customer and may affect the MRC at the time of the change. 


6. Service Management 


Effective support of in-scope services is a result of maintaining consistent service levels, The 
following sections provide relevant details on service availability, monitoring of in-scope 
services and related components, 


Si 
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6.1. Service Availability 


Coverage parameters specific to the service(s) covered in this Agreement are as follows: 
During the initial on-boarding process the following coverage parameters apply: 


¢ Telephone support : 8:00 A.M. to 5:00 P.M. Monday — Friday (MST) 
o Calls received outside of office hours will be forwarded to our On Call 
Voice Mailbox. Calls received from 5:00pm — 9:00pm and 6:00am — 
8:00am will be responded to within Ihr. From 9:00pm to 6:00am will be 
responded to between the hours of 6:00am — 8:00am. 


¢ Email support: Monitored 6:00 A.M. to 6:00 P.M. Monday — Friday (MST) 
o Emails received outside of office hours will be collected, however no 
action can be guaranteed until the next working day. 
After the initial on-board is complete, telephone, email and remote support will be 
available 24x7x365, 


The three appointed senior PRN engineers assigned to Customer are: Pau! Combetta-Primary Consulting 
Engineer & Project Manager, Bill Thornton-Secondary Consulting Engineer and Craig Papke-lOC/Help 
Desk Manager. One of the three will be available immediately from 6 am —6 pm MST Monday-Friday. 
We cannot guarantee their immediate availability aNer business hours, weekends or holidays. All other 
support will be available 24x7x365. 


6.2. Service Requests 


In support of services outlined in this Agreement, the Service Provider will respond to 
service related incidents and/or requests submitted by the Customer within the following 
time frames: 


e All Service Requests will be responded to daily. Priority will be determined 
mutually between PRN and Customer. 

e High Priority requests will be addressed same day. 

¢ Medium Priority requests will be addressed within 48 hours. 

e Low Priority requests will be addressed as scheduled. 


PRN employees, IOC and Intuition Help Desk employees, will not access any Customers email content or 
Customer's Exchange infrastructure without prior permission from the Customer and only if the approved 
access [s for Customer account basic remedlation purposes, In the event remediation requires admin access 
to the Customer’s Exchange infrastructure and the Customer grants PRN permission to access, the only 
appointed and approved PRN employees who will be granted admin access are the following: 
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6.3. Intuition Operation Center Key Performance Metrics 


: Response SL 


Ticket Handled 
Immediately, 
Work until resolve 


15 Minutes 
(Phone Call 
Required) 


ai 


24-48 hours 


4 Hours 


Same Day 


ey = kes. NS eer Oe 


"ARGET: 


ERVAL : 


Calls answered 2 Monthly 


Average Speed to Help Desk | ie Nionthfy a 
“Support: vas Fae ane ¥ 


% af Calls Answered within 


r ASA Target + Monthly 


6.4. Help Desktop Key Performance Metrics 


‘system attendant 


| Average Speed to ticket-assignment and 
resource allocation for Help Desk Issue. 


‘90% of all ticketed calls will be assigned and. 
-|-worked on within 30 minutes upon entering «. 


This ls an EMERGENCY condition that 


significantly restricts the use of an 
application, system or network ta 
perform any critical business function. 
This could mean that several users are 
impacted. 


The reported Issue may severely restrict 


use of key devices in the network, This 
could mean that multiple users are 
impacted but the overall network and 
servers functioning 

The reported issue may restrict the use of 
one or more features of the system, but 
the business or financial Impact fs not 
severe. 


The reported anomaly tn the system does 
not substantially restrict the use of one or 
more features of the product to perform 
necessary business functions. 


Py Soe SES S 


Inbound call answered without automation or 


queue. 
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FEE SCHEDULE 


Platte River Networks Inc. (“Platte River Networks” or "PRN”) and CESC (“the Customer” or “Cllent”) located at 750 Third 
Ave., New York, NY 10017, agrees as follows: 


The Customer will pay Platte River Networks a monthly recurring fee (MRC) totaling $2,495.00. Customer will be 
invoiced the MRC on the first day of each month on a monthly basis. The initial MRC for the first month of service-July 
2013, will be prorated based on the July start date. The Customer will pay a §12500;00 one-time Intuition setup fee. 
Platte River Networks and Customer will meet on 10/15/2013 for an account review to discuss the monthly recurring fee 
golng forward. 


ERVICE CLASSIFI ON: 
Platte River Networks will provide the following services to Customer: 


e Intultion Premium 24x7%x365 Services: Please see Intuition Service Level Agreement {SLA-Premlum) for additional 
information. 


e Project Work as needed or requested by Customer — Any service that is not Included In the Intuition Service 
Level Agreement will be based on the PRN Fee Schedule below, 


¢ Projects — When a project has been identified, PRN will provide Customer with an Initlal project estimate {quote} 
that must be approved and signed by Customer prior to the project work beginning, Once the Initial project 
quote Is signed by the customer, PRN will complete Due Diligence: gathering documentatlon for the project, 
creating a project plan and generating a final project Scope of Work (SOW). PRN will present the SOW to the 
Customer for flnal approval before proceeding with the project. Should the Customer request to change the 
Scope of Work during the project, PRN will provide the Customer with a Change Order Form to be approved and 
signed by the Customer prior to the commencement of any additional work. 


PROJECT HOURLY RATE- Any service that is not included in the Intultion Service Level Agreement will be based on the 
PRN Fee Schedule below: 
$125 per Hour billed in 15 minute increments 


PRN will obtain approval from Customer prior to incurring travel expenses. 


Client fs asked to notify Platte River Networks of any/all changes to their network environment at least 30 days prior to the change 
takes place including all: office location, hardware, software, telecom/circult, printing/copying/scanning, and website/DNS, 
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The Customer will pay Platte River Networks on Net 15 terms calculated from the date of the Invoice. Any charges onan 
invoice that remain unpaid 30 days past the due date will be assessed a $25 late payment fee per Invoice, and a monthly 
interest rate of one and one-half (1 4%) percent. 


Platte River Networks reserves the right to suspend service in the event that Customer’s monetary balance for any 
Invoice exceeds 30 days past due (60 days past Invoice date). Any disputes regarding charges on invoices must be 
brought to Platte River Networks’ attention, in writing, within 15 days from the date of the Invoice, otherwise the 
charges on the involce will be deemed valid. 


(3) TERMINATION: 


Either Party may elect to terminate the Agreement at any time with or without cause, subject to the conditions set forth 
herein. In the event that a Party elects to terminate the Agreement, the terminating Party will provide the other Party 
written notice of such termination at least thirty (30) days prior to the termination date. 


Either Party may terminate this Agreement upon the breach by the other Party of any of the terms or provisions of this 
Agreement, unless such breach is cured within fifteen (15) days after written notice thereof; 


PRN hereby agrees that Customer may immediately terminate this Agreement, without any notice to PRN in the event 
that Customer determines In good faith that PRN has breached any term or condition set forth in Section 6 
(Confidentiality) of this Agreement. 


Either Party may terminate this Agreement immediately in the event that the other Party: (i) becomes insolvent, 

(ii) makes an assignment for the benefit of creditors; (ti!) files a voluntary bankruptcy petition; (iv) acquiesces to any 
involuntary bankruptcy petition; (v) Is adjudicated bankrupt; or (vl) ceases to do business, In each case by written notice 
by the terminating Party to the breaching Party. 


Should Customer termInate this Agreement within 6 months of initial contract acceptance date, a termination fee equal 
to one month intuition service fee will be applied. 


Upon termination of this Agreement, all outstanding undisputed balances must be paid immediately in full. 


(4) HARDWARE & SOFTWARE PURCHASES: 


Customer must review, sign and return quotes to complete an order. Payment for hardware and/or software invoices 
are due before Piatte River Networks will process the order (Visa, MC, American Express and checks are accepted forms 
of payment). Labor costs will be invoiced separately from materials. Platte River Networks provides this good faith quote 
based upon their research of Customer's current technology structure and future needs. If the installation and/or 
configuration of Customer's network by Platte River Networks encounters a problem requiring more hours than are 
included in the Itemized allocation on this quote, Platte River Networks will notify Customer to discuss the matter and Its 
resolution as a possible additional purchase order. 
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(5) SOFTWARE LICENSING: 


Platte River Networks does not support unlicensed software. Customer represents that all installed software Is licensed. 
In the event that Customer has any unlicensed software on premises, Customer Is responsible for notifying Platte River 
Networks of such so that a remediation plan can be prepared and implemented to assist Customer in achieving 100% 
license compliance. 


46) CONFID IAL INFORM N: 


Platte River Networks will keep all Information gained as a result of Its services to Customer about the Customer's 
Operations and business practices confidential, except In cases where divulgence of certain information Is necessary to 
perform a task requested by the Customer, and Platte River Networks receives the Customer's consent to do so, or in 
cases where the Information Is or becomes part of the public domain other than as a result of unauthorized disclosure 
by Platte River Networks. 


Platte River Networks at Its sole cost and expense, shall at all times during the term of this Agreement maintain 
insurance and furnish certificates from the Insurance carrier evidencing said insurance, which shall include, but is not 
limited to; (i) errors and omissions insurance in the amount of $1,000,000; (ii) comprehensive general liability Insurance 
in the amount of $2,000,000; and (ili) any other usual and customary policies of insurance applicable to PRN's line of 
business. 


8 IABILITY: 


in no event shall either Party be Ilable for any Indirect, incidental, special or consequential damages, Including loss of 
profits, revenue, data, or use, Incurred by either Party or any third party, whether in an action in contract or tort, in any 
way arlsing from either Party's performance or nonperformance of this Agreement, even If the other Party or any other 
person has been advised of the possibilty of such damages. In no event shall either party's liability for damages 
hereunder exceed $2,000,000, except for damages which have directly resulted from PRN’s gross negligence or willful 
misconduct in connection with providing or failing to provide the services under this agreement. 
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(9) PRINCIPAL CONTACTS: 


CUSTOMER [NFORMATION: 

Company Name: CESC 

Billing Address: 750 Third Ave. 

City: New York State: NY Zip: 100137 
Phone: 212-485-5800 


(A) PRIMARY FINANCIAL CONTACT: (Authorized signer) 


(B) PRIMARY TECHNICAL CONTACT: (Cllent on-site project manager, responsible for 
prioritization of projects and tasks and has authorization to schedule work and act on behalf of 
primary financial contact). 


(C) BILLING CONTACT; (Invoices will be sent to this person at the address listed above unless 
alternate billing address Is listed below. Thls person js not authorized to request service from 
Platte River Networks) 


(D) ADDITIONAL TECHNICAL CONTACT: {Piease list any additional contacts beyond A and B 
above that are authorized to request services from Platte River networks.) 


Please provide additional service locations and spectal billing Instructions. 
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(10) APPROVAL: 


This Agreement shall be governed and enforced In accordance with the !aws of the State of Colorado and may not be 
assigned by Customer without the prior written consent of Platte River Networks. This Agreement su persedes all prior 
agreements and understandings between Platte River Networks and the Customer relating to the subject matter of this 
Agreement. Performance of services by Platte River Networks Is subject to interruption or delay due to causes beyond 
its reasonable control such as acts of God, government, weather, fire, power or telecommunications fallure, labor 
dispute, inablllty to obtain supplies, or breakdown of equipment. The terms set forth here constitute the entire 
agreement of the partles, and any additional or different terms or conditions set forth In any other document shall be of 
no effect. 


Sign below to Indicate your approval and acceptance of this agreement. 
Please sign 2 copies and retain one copy for your records. 


CUSTOMER 


b6 


Signature: BiG 


Print Name: 


Title: 
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Signature: . Date: 
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Title: 
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IOC Infrastructure & Help Desk Customer Inventory 


Servers 
+ VMWare liost Dell PowerEdge R620 
¢ xchange server . 
* . Domalii Controller 
¢ Blackberry server 
* Datto BDR SIRIS 2060 


Network Devices 


+ ' Fortinet FortiGate 80C Flrewall:x 2 
* Dell PowerConnect 2824 Switch:x 2 


Users 


® 25 end users 
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Introduction 


This document specifies the scope, schedule, guidelines and procedures for services delivered by Platte River Networks 
(PRN) and our Intuition Operations Center (IOC) and Intuition Help Desk Services to the CESC (Customer) and the 
Customers end users. Delivery of these services is bound by the conditions outlined in the Intuition Premium Service 
Level Agreement (“SLA”). 


lOC Services 
SERVICE IOC SERVICES 
Deployment and use of v 


Intuition Workplace policy 
modules for monitoring 


and alerting 

Alert Notification iv 
Performance of Scheduled v 
Maintenance Activities 

(against SLAs) 

Daily Service Summary . v 
Reporting 

Monthly Executive v 
Summary Reporting 

Remote Remediation v 
Advanced Problem v 
Management 
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IOC Services — Alert, Respond and Resolve 


Alerts are verified as genuine and actionable or closed. Management tickets are created for all actionable issues in the 
10C and all interconnected systems as applicable for regular reporting. Alerts deemed actionable by the IOC team are 
resolved according the SLA. When alerts are not actionable by the lOC team, timely notification to the Customer is 
made, based on the priority of the alert and device. Similarly, remediation information is updated in these tickets and 
shared across interconnected systems as applicable. , 


Internet-access related issues where IOC Engineers have been authorized to act on behalf of the Customer will be 
resolved with the Customer’s Internet Service Provider (ISP). 


Regular daily and monthly reporting will be available to the Customer as will per-incident recommendations and root 
causes analyses. Incidents are prioritized with the following classifications and responded to accordingly as per the SLA. 


IOC Maintenance Activities 


Any and all maintenance activities that can be completed using pre-existing automation options in JOC will be 
performed. Where no current means of automating the activity exists, the IOC may be engaged to supply scripted 
‘solutions. 


All relevant information about a failure is documented and provided in the ticket, along with any other prescribed 
notification (such as email or telephone contact) required. IOC will continue working to resolve the issue until the 
maintenance activity has been completed. 


For example, if an automated task to defragment a hard drive has failed to complete, IOC will monitor how many times 
this activity has failed on the device and identify any possible root causes, like insufficient disk space, to complete the 
operation. IOC Engineers will immediately address the low disk space issue by performing a disk cleanup. If that fails to 
provide sufficient free space, a list will be compiled of objects occupying the greatest percentage of the disk, and 
promptly provided to the Customer with recommendations for freeing more space (such as, identifying databases, data 
files, or programs that can be moved to other partitions or network locations). 


Any code-related defect suspected or identified in OC that impacts the ability to deliver maintenance services will be 
escalated until the issue is resolved. 
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NOC Maintenance Activities for Workstations 
Non-Windows operating systems are managed using SNMP only. 


~ MAINTENANC! 
“activity” 


Monitoring Continuous Monitoring will be configured using IOC policy modules except where the 
Customer has specified pre-existing policy modules for continued use. All 
products for which a policy module exists are eligible for monitoring services. 
Device-level monitoring for all supported protocols is available upon request, 


or will be maintained where pre-existing. 


DESCRIPTION 


Green Computing Daily or as All non-essential workstation class devices will be shut down and/or woken 
defined daily on an automated schedule to save energy costs. Windows power 
management plans will be remotely configured as requested. 


This service is available upon request only. 


AV Services Daily All definition and signature updates are performed on a daily or as-needed 
basis. Quarantine or clean actions are taken to best protect data integrity and 
stem the infection from compromising network systems. 

Disk Health Audit Monthly An extensive checkdisk (CHKDSK) routine is executed upon logical drive c:\ 
creating error events that will trigger alerts for all issues identified. 


Disk Cleanup Weekly Temporary files and Temporary Internet files are removed on all Windows 
devices. 

Disk Monthly Defragmentation of all fixed disks using operating system native utilities. 

Defragmentation 


Microsoft Patch Weekly or as | Microsoft patch management will be configured using IOC update agent 
Management defined policies and approval groups except where the Customer has specified pre- 
existing update agent policies and approval groups for continued use. All 
products and classifications for which IOC support exists are eligible for patch 
management services. 


By default, critical and security updates for all present software components 
will be approved and automatically installed. Service pack installations are 
performed by request as a scheduled activity. 


Application Weekly, Third-party applications for which update scripts are included in IOC will be 
Updates Monthly scheduled on a weekly basis except where the Customer has a pre-existing 
schedule. 
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NOC Maintenance Activities for Servers 


SNMP monitoring will also be configured where available. Non-Windows operating systems are managed using SNMP 
only. 


MAII SCHEDULE. _| ‘SCOPE, 
ACT “apo i | Press oF 

Monitoring Continuous Monitoring will be configured using !0C policy modules except where the 
Customer has specified pre-existing policy modules for continued use. All 
products for which a policy module exists are eligible for monitoring services. 

“| Device-level monitoring for all supported protocols is available upon request, 
: or will be maintained where pre-existing. 

AV Service Daily All definition and signature updates are performed on a daily or as-needed 
basis. Quarantine or clean actions are taken to best protect data integrity and 
stem the infection from compromising network systems. 

Disk Health Audit Monthly An extensive checkdisk (CHKDSK) routine is executed upon logical drive c:\ 

, creating error events that will trigger alerts for all issues identified. 


Disk Cleanup . Weekly Temporary files and Temporary Internet files are removed for all! profiles on 
all Windows devices. ; 

Disk Monthly Defragmentation of all fixed disks using operating system native utilities. 

Defragmentation 


Microsoft Patch Weekly or as Microsoft patch management will be configured using 1OC update agent 
Management defined policies and approval groups except where the Customer has specified pre- 
existing update agent policies and approval groups for continued use. All 
products and classifications for which IOC support exists are eligible for patch 
management services. 


By default, critical and security updates for all present software components 
will be approved and automatically installed. Service Pack installations are 
performed by request as a scheduled activity. 


Application Monthly Critical, Security and Definition updating for all other applications as named by 

Updates the Customer where not requiring vendor-approved contact or access to 
restricted portals will be scheduled. Depending on automation schedule, anti- 
malware definitions should be updated on a daily basis. 
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NOC Maintenance Activities for Network Infrastructure 

Supported infrastructure devices includes, but are not limited to, IP-based hardware and software firewalls, switches, 
routers, bridges, VPNs and security devices. Note that these devices must support, SNMP and/or syslog monitoring and 
management, where protocols or logs are exposed that provide status information in a format that may be read by IOC. 


are 


ACTIVITY, © 0} SCHEDULE 


Continuous ° — Availability 
e Bandwidth utilization 
e Service availability (FTP, HTTP, VPN, etc) 
e Resource monitoring (CPU, memory, sessions, etc) 
e Performance 
Firmware Updates 


NOC Maintenance Activities for Network Printers 


Supported print devices include, but are not limited to, IP-based hardware and software from all major vendors. Note 
that these devices must support, SNMP and/or syslog monitoring and management, where protocols or logs are 
exposed that provide status information in a format that may be read by IOC. 


SCHEDULE 


Continuous 
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Monitoring 


Critical and security patches for the firewall operating system will be 
installed. 


Security patches are reviewed and installed based on releases by the 
technology vendor on an as-needed basis that conforms to the change 
management policy. Configuration backup of the device will be taken 
before the patches are installed on the devices. 


“ACTIVITY © SCOPE 


Monitoring will be configured using IOC policy modules except where the 
Customer has specified pre-existing policy modules for continued use. All 
products for which a policy module exists are eligible for monitoring 
services, ; 


Monitoring 


Device-level monitoring for all supported protocols is available upon 
request or will be maintained where pre-existing. 
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NOC Maintenance Activities for Other !P-based Devices 


Supported devices include, but are not limited to, IP-based hardware and software installed on the same, such as 
firewalls, switches, routers, bridges, VPNs and security devices. Note that these devices must support, SNMP and/or 
syslog monitoring and management, where protocols or logs are exposed that provide status information in a format 
that may be read by IOC. 


Monitoring will be configured using OC policy modules except where the 
Customer has specified pre-existing policy modules for continued use. All 
products for which a policy module exists are eligible for monitoring 
services. 


Monitoring 


Continuous 


Device-level monitoring for all supported protocols is available upon 
request, or will be maintained where pre-existing. 


NOC Maintenance Activities for Connectivity 


IOC Services will, when provided with access and authorization to do so, act as your agent in all communications with 
managed end-client Internet Service Providers (ISPs) to resolve the issues with the primary Internet connection or other 
named connections, as described in the table below as as-needed responses to issues. 


ACTIVIT 2 | SCHEDULE. “SCOPE 

Connection Continuous IOC Services will open a ticket with the ISP and perform action able tasks in 

Assurance support of resolution, including communicating via email, chat, and phone 
or as applicable. Email or phone notification will be provided to the 
Customer. 


The Customer must provide the following details prior to commencement of 
service: 
e Name of the ISP 
e Location of the client 
e Bandwidth / service plan details 
e = Circuit ID 
¢ Service provider member ID 
e {SP online credentials to create ticket 
Failover On-demand IOC Services will back up the configuration of network devices. Backup will 
be stored on the Onsite Manager server for disaster recovery purposes and 


for configuration management. Configuration backup is only available where 
supported by the managed device. 


Vulnerability Monthly A scheduled monthly external vulnerability scan is performed for one or 
Scanning more public IP addresses. 
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NOC Maintenance Activities for Microsoft Exchange 


Monitoring Continuous Comprehensive monitoring collects continuous performance metrics and 
critical Windows log events. SMTP and MTA statistics are gathered and 
interpreted 24/7. 

Service Assurance Consistent running state of Windows services is managed 24/7. 

Database Continuous Management of all database and log files disk space 

Management (selectively/collectively), performance of each disk and I/O balancing across 


disks, management and monitoring of database size and traffic. 
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Additional IOC services 


The following additional remediation and maintenance services are offered. 


Microsoft Patch 
Management 


Any issues observed during or following updates will be worked and resolved 
by the IOC team within the appropriate priority tier of the SLA, including 
unsuccessful installations and suspected generation of secondary issues. 


Weekly or as 
required 


rosoft Exchange. 


Complete security hardening exercise will be performed during scheduled 
non-production hours, Key components include hardening the Windows 
infrastructure, back-end and front-end servers. a 


Security Assurance | Quarterly 


Ongoing administration for creating objects in the Exchange server and 
configuring distribution lists, mailboxes, user groups, and calendars. Backups 
and database redundancy are validated and restored or otherwise managed 
as necessary in response to failure conditions. 


Administration Upon request 


Firmware Updates | Ongoing Patches for the device firmware will be installed. 


Service not available for smartphones. 
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IOC Services Reporting 


A 


7 


Regular reporting on IOC Services includes but is not limited to the following. Reports listed will be available to the 


Customer and archived. 


Daily Activity Summary 

The Dally Activity Summary provides a daily summary of the following: 
open tickets 

closed tickets 

automated activities performed 

remote sessions conducted 


Monthly Activity Summary 
The Monthly Activity Summary provides a monthly summary of the following: 


open tickets 

tickets open for more than one day 

closed tickets 

automated activities performed 

remote sessions conducted 

graph summarizing year-to-date tickets, organized by month 
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Intuition Help Desk Services 


Where IOC Services are focused on the client’s infrastructure, the function of Intuition Help Desk Services is to support 
individual users. Our Help Desk (HD) team provides 24/7 remote assistance and repair to help the Customer's end users 
use their technology—reducing downtime and increasing their productivity. 


We set up a dedicated phone number for the Customer, only the Customer will have access to this phone number. 


We set up a dedicated email for the Customer. The Customers end users receive 24 /7 HD support to troubleshoot and 
fix all third-party and operating system issues at the workstation level through the dedicated phone number, IOC remote 
tools, and email. The method of communication is the choice of the end user. Upon end user approval, our Help Desk 
Technicians can remotely control the end user’s desktop in order to expedite remediation, and if requested by the end 
user, will call the end user on the phone to expedite the resolution process. 


Help Desk issues that cannot be resolved at the level of the single workstation and end user are escalated directly to the 
IOC for resolution with an explanation of the issue. 


Features of Help Desk Services 


Intuition Help Desk Services feature the following: 


e End-to-end support for PC, Mac and alternative operating systems, applications and devices. 

© Certified experts providing live, experienced assistance to the Customer’s end users for all aspects of their 
interaction with information technologies. 

® Dedicated phone number, email instantly connects the Customer's end users with our Help Desk Technicians so 
best-in-class support is available any time of day, from anywhere in the world. 


e Remote access technologies enable our Help Desk Technicians to perform direct diagnostics, determine what 
the end user’s technical problem is, implement corrections and instruct the end user to achieve resolution 
without interrupting the end user. 

© Help Desk Technicians will use advanced screen sharing and remote workstation control tech olutes 
extensively, upon Customer’s end user permission, to facilitate superior understanding of end user issues and 
questions, and to illustrate and execute appropriate solutions most effectively and efficiently. 


e If requested by the Customer’s end user, a Help Desk Technician will call the end user on the phone to expedite 
the resolution process. 
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Intuition Help Desk Scope of Services for PC and Mac Workstations 


Help Desk includes support to answer Customer end user questions and resolve issues that can include, but are not 
limited to: 


Assistance with the operation and configuration for all workstation-class operating systems, encompassing all user- 
originated activity and requirements, such as installation and removal of applications, enabling user-specific settings, 
peripheral management, and resolving system or application error messages received, 

Help with basic networking configuration of user-specific devices such as workstations, phones, laptops and tablets. 
Internet connectivity using DSL, cable, or wireless modems, routers, and transceivers which are not business- or 
enterprise- class devices. This includes registering computers on networks, configuring availability of or access to shared 
network resources including file systems, printers, scanners, fax servers, mail servers, and Blackberry servers. 


Supporting all line-of-business and productivity applications by ensuring vendor-recommended software updates have 
been installed and that the integrity of the installation its configuration allows for expected performance levels. This 
includes complete removal and secondary installation, as required, where licenses and installation sources are available. 
Where data loss is a potential outcome, PRN will advise users of this possibility and assist in preventative efforts 
including using backup applications or migrating data directories, but will not be held responsible for data loss occurring 
during user-approved activity. 

Verification and optimization of performance of user-level devices. 

Removal of all types of malware including viruses, Trojans, spyware, browser hijackers and botnets. 

Remote diagnosis and remediation of faults with interoperation of operating system and device hardware, driver 
evaluation, installation and upgrades. 

Connectivity assurance with bring-your-own-device endpoints such as cameras, storage devices, phones, and 
multimedia players. 

Appropriate and safe use of Internet-enabled technologies including Web browsers, FTP clients, online storage services 
and news readers from all manufacturers. 

Configuration and use of all Internet-related security applications including personal firewalls, malware scanners and 
blockers, proxy and privacy clients. 

Operation of office and multimedia applications from vendors such as Microsoft, Apple and Adobe. 
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Intuition |OC Services Exclusions 


IOC Services shall not be provided under any of the following circumstances or for the following items or programs: 


When requested actions violate copyright laws, or introduce liability concerns that limit processes to those that 
render incomplete required steps for successful completion of the task. 


Authoring of code-based content, including but not limited to, shell or user mode scripts, applications, web 
pages, applets, or other development solutions. 


Authoring of media-based content, including but not limited to, graphics, copy text, audio or visual content. 
Where resolution of identified faults require correcting code-based defects in applications or firmware. 


When end-users are unable to provide sufficient proof of identity and are asking for security related information 
such as non-default access to network resources, passwords, activity histories, etc. 


Intuition Help Desk Services Exclusions 


Help Desk Services shall not be provided under any of the following circumstances or for the following items or 
programs: 


When requested actions violate copyright laws, or introduce liability concerns that limit processes to those that 
render incomplete required steps for successful completion of the task. 


Authoring of code-based content, including but not limited to, shell or user mode scripts, applications, web 
pages, applets, or other development solutions. 


Authoring of media-based content, including but not limited to, graphics, copy text, audio or visual content. 
Where resolution of identified faults require correcting code-based defects in applications or firmware. 


When the activity requires on-premise physical access to a device during period of work, or following 
configuration changes (BIOS flash, power-cycling devices not WOL enabled). 
Change to core components of an operating system or application introduces potential barriers to further 


remediation or remote remediation, such as changes to Windows Registry, .NET Framework or WMI repository ~ 
made manually and not under direct vendor advisement with express approval of PRN and the Customer. 


Additional Clause 


PRN employees, 1OC and Intuition Help Desk employees, will not access any Customer's email content or Customer's 
Exchange infrastructure without prior permission from the Customer and only if the approved access is for Customer 
account basic remediation purposes. In the event remediation requires admin access to the Customer's Exchange 
infrastructure and the Customer grants PRN permission to access, the only appointed and approved PRN employees who 
will be granted admin access are the following: 


b6 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 1/6/2016 


On January 6, 2016, two separate LHMs were provided to the Central Intelligence Agency (CIA) 


requesting use authority to show documents containing CIA equities during future interviews related to 
the captioned matter. The LHMs were provided to CIA jadi b3 per CIA 
b6 per CIA 


Copies of the LHMs are enclosed in an attached 1A. 


b3 
Investigation on ___ 1/6/2016 at Washington, DC BIE 
File # ~ 12 Date dictated __ N/A 
b6 
By SA b7c 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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t. Interim Government Struggling to Restore Order in Capital 
md Across North; Exercising Weak Authority in Country's 
south. Following the 2005 revolution, the new government was able to 
restore peace to the capital and exercise its authority across the nation 
within 72 hours. This was largely due to Feliks Kulov, an opposition leader 
who wasa career policeman and commanded deep respect within the police 
forces. Following the 2010 revolution, the interim government continues to 
have an extremely difficult time restoring order two weeks later. A large 
part of the problem comes in motivating the police and getting them back 
out on the street and doing patrols. Relations between the government and 
the police rank-and-file are terrible and police claim that they risk being 
beaten or shot simply by going out on the streets. Much of this stems from 
breeding resentment over the deaths (now put at 85, but with hundreds still 
in the hospitals with wounds, nearly a hundred with life-threatening 
wounds). The break down in law and order is reaching Hobbesian 
dimensions. Squatters, frequently armed with iron bars and stones, and 
sometimes with guns, attempt to occupy homes and buildings on the 
outskirts of the capital. In the Issyk Kul resort area, several hotels and 
ozens of vacation villas have been seized. But spontaneous “squatters 
actions” ate reported all across the country, and government authority is 
especially feeble in the south (and hardly apparent in the Jalalabad 
Province). Government leaders express confidence that they will get the 
situation in hand, though they agree it may take some weeks. But others see 
serious vulnerability and point to menacing coverage of the situation in the 
Russian media, much of it broadcast into Kyrgyzstan, coupled with concerns 
of possible threats against ethnic Russians. The situation could be exploited 
by Russia as a pretext for police operations in Kyrgyzstan, but the Kyrgyz 
leaders I speak with consider this a remote possibility. Restoring police 
order across the country is still the top priority for the interim 
government. Recommendation: U.S. support to the new government to 
help restore police operations is critical; basics like paying salaries aud 
furnishing fuel is essential. 
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3, Base Politics, On balance, | believe the Manas Transit Center can be 
retained for another year. Beyond that, an assessment shouldn't be 
attempted until after the fall parliamentary elections and the formation ofa 
new government. However, the effort is increasingly difficult, and there is 
little margin for error. The U.S. has to play its cards very astutely to get 
through this. There are three keys to success: 


1) Work with Russia. As one of Otunbayeva's assistants tells me, “If this is 
a Russia vs. U.S. matter, you shouldn't be in suspense: the U.S. loses.” That 
saine iriterlocutor told me, however, that the U.S. was playing things “Just 
right” by working at the White House level through Medvedev and making 
the case for the base in the context of joint Interests. Russia will continue 
low-level anti-base propaganda, and the U.S. can survive this. But if Russia 
turhs up the heat, the new government will jump to tts tune. There is a 
strong sense that Russia is justly angry because Bakivev took their money 
and betrayed them, arid that Russia has to be appeased over this. 


(6) Admit Mistakes. Beknazarov is building a case against the U.S. over the 
fuel contracts. He is arguing that they were a form of bribery pursued by the 
U.S. to corrupt the government. He has assembied a strong evidentiary 
portfolio already. Kyrygz prosecutors have shown me documents showing 
much of the paper path between Red Star/Mina and DOD; they have 
payment records to the Bakiyev-controlled companies; they even have 
pricing data showing that fuel was being sold at around $3.25. They have 
ietailed research o role and tapes of some of his weep ree 
ommunications which show Him operating as if he were a fully integrated 
part of the DESC team, and they've identified other figures in the Red Star 
operations in London who they believe are U.S. intelligence 
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. ALL TNEURLATION CONTAINED 
HESEIN [8 UNCLUASSIEIED 
DATE ll-ee-20le By JF eUlLeTS0 NSILG 


U 


Bp Platte River Networks invoice 


5700 Washington St 
| Date | invoice # | 


networks 303.255.1941 


Bill To: e ‘ 


CESC 
Marcum LLP , 
750 Third Avenu 


New York, NY 10017 


[Sewices__[____Desoription | Units | Rate | Amount] 


2/11/2014 Task/Ticket: Remote Support-T&M 125.00 125.00 
T20140211.0015 

Summary Notes: 2/11 1 hour 

* Worked with Monica to import HRC’s archived email into 


separate archive i 
Resource Name 


= 


Subtotal $125.00 
Sales Tax (0.0%) $0.00 
Total $125.00 


Payments/Credits -$125.00 
Balance Due * $0.00 


Thank you for your business! 


Your prompt payment is appreciated. A late fee of $25.00 and a monthly finance charge of 1 1/2% (18% 
annually) may be assessed for invoices not paid within terms. 


Any disputes should be reported within 15 days of the invoice date or all charges will be deemed as 
acceptable by the client. In the event of non-payment, the client will also be responsible for collection and 
attorney fees incurred in collections efforts. 


Please direct all billing inquiries and requests to the Accounting Department 
accounting@platteriver.com :: 303.255.1941 


HRC-1480 


b6 
b7C 


b6é 
b7C 


HEDRMATICN CONTAINED 


BRE 
Eas 


[rd H oiS UNCLASSIFIED 

a oS 11-28-2016 BY J76J18Ts0 NSiIcc bé6é 
_ant time: eeeec Si eae 
To: ta 

Ce: CRC th, 

Subject: RE: Current CESC usér is 


Did you hear anything back? 


| CLIENT RESOURCE REPRESENTATIVE 
© 303.255.1941 F 303.474.3942 b6 
PLATTE RIVER NETWORKS b7c 


IT SERVICES FOR BUSINESS 


Fro , 

Sent: Monday, June 09, 2014 9:48 AM b6 
To b7C 
Cc: CRC 


Subject: RE: Current CESC user list 


: : ; i 
[iter are all of the active mailboxes, minus a few system ones: 
4 b6 


Administrator b7C 


b6 
b7Cc 
CCM 


ffice Scheduling 


Finances Office 


H hrod17 


helpdesk 
HRC Archive 
Huma Abedin 


Saal 


Justin Admin2 
tin Cooper 


fj 


Sent: Friday, June 06, 2014 3:49 PM ee 
To b7C 
Ce: CRC 

Subject: RE: Current CESC user list 


[__ . HRC-1482 


Can you provide a list of all current mailbox by domain and we will review the list and confirm ail the current mailboxes. 


Thanks 


Clinton Foundation 
Direct 


Cc: CRC 
Subject: Current CESC user list 


| Can one of you provide us with a current list of the active CESC employees? We have all of the old and 
: = t 7 size - J . : 
current users listed on the servers, but would like to make sure that we’re maintaining the ‘real’ user list in our ticket/CRM 


back 
system accurately. i 


a 


This email has been scanned for email related threats and delivered safely by Mimecast. 


For more information please visit http://www.mimecast.com { 


os 


Oe 
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b7Cc 


b6 
b7Cc 


ALL INEORIAT 


HEREIN 


DATE 11-28-2016 BY [76018 7e0 HS 


Platte River Networks 
5700 Washington St 


Denver, CO 80216 
303.255.1941 


e 


PLATTE RIVER 


networks 


CESC 


750 Third Avenué 
New York, NY 10017 


Description 


Task/Ticket: On Call-Email Archive 
T20140225.0074 
Summary Notes: 2/25 
* Export/import 0 
Resource Name: 


2/25/2014 


2 hours 
ive to current email system 


Thank you for your business! 


Your prompt payment is appreciated. A late fee of $25.00 and a monthly finance charge of 1 1/2% (18% 
annually) may be assessed for invoices not paid within terms. 


Any disputes should be reported within 15 days of the invoice date or all charges will be deemed as 
acceptable by the client. In the event of non-payment, the client will also be responsible for collection and 
attorney fees incurred in collections efforts. 


Please direct all billing inquiries and requests to the Accounting Department 
accounting@platteriver.com :: 303.255.1941 


riot dont [a Date 


| Units _| 


OH CONTAINED 
= UNCLASSIFIED 


co 


Invoice 


2/28/2014 35593 


Net 30 


3/30/2014 


125.00 250.00 


Subtotal $250.00 
Sales Tax (0.0%) $0.00 
Total $250.00 


Payments/Credits -$250.00 


$0.00 


Balance Due * 


HRC-1484 


b6 
b7c 


b6 
b7C 


On Fri, Apr4, 2014 at 0:11 AMP wrt: 
Sorry, missed this the first time around. Yes, the email has been imported into an archive mailbox on 
the server, and | can send the mac back to you soon 


Sent: Friday, April 04, 2014 10:10 AM 
To: Monica Hanle 


Subject: Re: HRC emails 


Just checking back on this[__is it still with you? Thank youl | 


Hi i ee up on this. Let me know when the wiped laptop is ready to be 


shipped best to send it to the foundation at: 
Hill 

c/ 

127! Avenue of the Americas 

42nd Floor 


New York, NY 10020 


Let me know once it's gone out so we know to expect it. Thanks| | 


On Mon, Feb 10, 2014 at 9:03 PM, Monica Haley wrote: 


sounds great 
if tomorrow falls through for you, we can find another time. Will email you in the morning. 


Hi Monica- 
| should be able to work with you on this tomorrow morning, can we shoot for around 11a EST? 


From: Monica Hanley [mailto:monica.hanley@gmail.com] 
Sent: Monday, February 10, 2014 8:55 PM 


To \ 
Cc 
Subject: HRC emails 


H 

[ am no longer with HRC's office (Jan 31st was my last day) but | wanted to try to finish the 
HRC email project which requires sending all of her archived email to your server. You recall 
that we couldn't figure out a way for you to connect to the laptop that | have in my possession. 


b6 
b7C¢ 


b6 
b7c 


b6 
b7Cc 


b6 
b7c 


b6 
b7Cc 


b6é 
b7C¢ 


b6 per DOS 


b6 
b7C¢ 


b6 
b7c 


b6 
b7c 


HRC-1486 


Do you have time to try tomorrow? Last time, I tried from HRC's home but tomorrow I can try 
from my home, which has good wif. 


b6 


I'm adding —_ for her situational awareness| _ as soon we've transferred the email, I'll — 


figure out a way to get the wiped laptop to you. 


best, 


a 


This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit http:/Awww.mimecast.com 


SS err a ssrA 


ns 
This email has been scanned for email related threats and delivered safely by Mimecast. 


For more information please visit http://www.mimecast.com 
a ee a re ee ee 


—— 
This email has been scanned for email related threats and delivered safely by Mimecast. 


For more information please visit http://www.mimecast.com 
re 


This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit http://www.mimecast.com 


HRC-1487 


Date: Wed, Apr 9, at /:1 b7c 
Subiect: Re: i 

To 

That's perfect 


b7C 


Sure thing. Earlier in the day is better- can we shoot for around 10am? 


Fro [mailt b6 
Sent: Wednesday, April 09, 2014 6:38 PM b7Cc 
To 


Subject: Re: HRC emails 


Apologies - is there a good time for you to go through this on Friday? Thanks! be 
polog g you to g g y [| > 
OnWed Apr9, 2014 at 1236pM{_— rte 

Hi good to hear you're on the mend! | will try you a little later this afternoon. a 


On Wed, Apr 9, 2014 at 10:00 AM[__________________] wrote: be 
a | Sorry for the delay, | got extremely ill over the weekend and am just now feeling semi-human bIc 
again. 


If you have some time today, can you call me so | can give you the details on how to access HRC’s 
archived emails? 


Sent: Saturday, April 05, 2014 1: b7c 


To: Monica Hanley 
Cc; 
Subject: Re: HRC emails 


makes sense! would love the details - thanks! 


On Sat, Apr 5, 2014 at 11:54 AM, Monica Hanley wrote: Bes pes POF 


hi! 

I know I don't work with you anymore so no need to reply to me but if HRC wants access to he 
email, can she now access it through the web! | think you should update Huma and 
on where all of her old email is. 


b6 
b7Cc 
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ALL INECEMATION CONTAINED 
HEREIN [5 UND LASS eet 


‘ = . Ls 11-26-2016 Be J 76218780 HSloe 
PST Files - PRN Admin Server 


[FileName | Created Date | Modified Date [Location | System Status | 
HRC .gov email 7/23/2014 7/23/2014 11:43 AM C:\Users\administrator.CLINTON\ | Not present 
Archive.pst 11:43 AM Desktop Reueason 
HRC .govemails.pst | 7/23/2014 7/23/2014 3:46 PM C:\Users\administrator.CLINTON\ | Not present 
HRC govemails.pst | 7/23/2014 7/23/2014 3:48 PM C:\temp In Recycle Bin, 
export.pst 7/23/2014 11/18/2014 11:11 AM _ | C:\temp Not present 

fe ead 

HRC archive — Unknown Unknown C:\temp Registry only 


hrcarchive@clinton C:\Users\administrator.CLINTON\ | Registry only 
AppData... 


email.com — HRC 
Unknown Unknown C:\Users\administrator.CLINTON\ 
(temp file 
created 
7/24/2014 
10:55 AM) 


archive.ost 
AppData\Local\Microsoft\Outlook 


| |@gmail.com - 


HRC-1490 


b6 
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SLL INZORMATION CONTAINED 
HEREIN IS UN LASS a 


PRN Admin Server — PST Files DATE 11-28-2016 BY J76d1sTE0 NSICG 


1) HRC.gov email Archive.pst 


CESC-PRN-flat. vmdk/Partition 2/NONAME [NTFS}]/[root] /Users/administrator .CLINTON/AppData/Roaming/Microsoft/Windows/Recent/HRC -gov email Archive.pst.ink 


7/23{2014 11:43:56 AM (2014-07-23 15:43:56 UTC) 7/23/2014 11:43:56 AM (2014-07-23 15:43:56 UTC) 7/23/2014 11:43:56 AM (20 14-07-23 15:43:56 UTC) 


| Link target information 


‘Local Path er \Users\administrator. CLINT TON\Desktop\HRC -gov emait Archive. pst 

‘Volume Type — 7 |Fixed Disk a - m Se ete - 7 7 cae 
Volume Serial Number 4A62-8D8C 
iFile Size fo Sei - 

Creation time (UTC): N/A a *s ans ' 


Last write time (UTC) |N/A Ce ete eee 
Last access time (UTC) ‘N/A 
‘optional fields 7 Ee rr oa ee : Z 
[Relative Path I ‘\: A. .\. Ae .\Desktop\HRC gov, email Archive. pst a _ ie | 


| Working directory “1: ::\Users\administrator. CLINT ON\Desktop t 


2) HRC.gov emails.pst 


Path 
CESC-PRN-flat. vmdk/Partition 2/NONAME [NTFS] {root]/Users/administrator.CLINTON/AppData/Roaming /Microsoft/Windows/Recent/HRC .gov emails. pst. Ink 


Modified 


7/23/2014 3:46:28 PM (2014-07-23 19:46:28 UTC) 7/23/2014 3:46:28 PM {2014-07-23 19:46:28 UTC) 7/23/2014 3:46:28 PM (2014-07-23 19:46:28 UTC) 


Link target information a <= ee id “~~ . ; 
Local Path C: :\Users\administrator. CLINTON\Desktop\HRC .gov emails.pst ! 
Volume Type ae 2 |Fixed C Disk ; : ; : a - - | 
Volume Serial Number 4A62- BD8C_ 

[File size cae Sot fe cat Dey ate pn 
Creation time (UTC) |N/A on ee OO wee ee 


Last write time (UTC). [wa ret eae een as steed 


iLast access time (UTC) ‘N/A 


| Optional fields * 7 Se as. - | 
'Relative Path oS iN. A; A. a \Desktop\HRC | gov ‘emails. pst cictteat hota o.¢ ihe 7 
Working directory rs \Users\administrator.CLINT ON\Desktop 


HRC-1491 


3) HRC gov emails.pst — PST in Recycle Bin but empty 


Path . 

CESC-PRN-flat.vmdkjPartition 2/NONAME [NTFS}/[root] /Users/administrator. CLINT ON/AppData/Roaming/Mic osoft{Windows/Recent/HRC gov emails.pst.Ink 
Modified 

7/23/2014 3:48:10 PM (2014-07-23 19:48:10 UTC) 7/23/2014 3:48: 10 PM (2014-07-23 19:48:10 UTC) 7/23/2014 3:48:10 PM (2014-07-23 19:48:10 UTC) 
‘Link target information = Od a GE TS Oo | 
Local Path iG: ‘\temp\HRC gov emails. pst . 
|Volume Type —__=[ Fixed Disk a | rn oer) 
‘Volume Serial Number - - 4N62-81 8D8C_ Bo no ee os | 
Creation time (UTC) Nin 

ate ewite time (UTC) VA 
Last access time (UTC) ‘N/A : | 
Optional fields . 

Relative Path [. .\. “A. oN. Ns. ‘\: .\. \..\temp\HRC C gov emails.pst _ Kp ae 7 
‘Working directory 'C\temp State ay etek ae 


HRC gov emails.pst Recycle Bin file as SRBOUH6F. pst: 


Path 
CESC-PRN-flat.vmdk/Partition 2/NONAME [NTFS]/| [root] /SRecyde.Bin/S-1-5-21-21946671152-1263538465-33 10924795-500/¢RBOUH6F.pst 


Modified 


7/23/20 14 3:48:55 PM (2014-07-23 19:48:55UTC) 7/23/2014 3:48:57 PM (2014-07-23 19:48:57UTC) 7/23/2014 3:48:57 PM (2014-07-23 19:48:57UTC) 


Recycle date/time: 


Path 
CESC-PRN flat. vmdk/Par tition 2/NONAME [NTFS]/froot] /$Recyde.Bin/S-1-5-2 1-2146671 152-1263538465-33 10924795-500/$IBOUH6F. pst 


Modified 


7/23/2014 4:37:56 PM (2014-07-23 20:37:56 UTC) 7/23/2014 4:37:56 PM (2014-07-23 20:37:56 UTC) 7/23/2014 4:37:56 PM (2014-07-23 20:37:56 UTC) 


[ 
Original Name | :\temp\HRC gov emails. pst 
Logical Size [en 


Date Recycled | 7/23/2014 8: 37: 56 PM +00: 00 i 


HRC-1492 


4) export.pst 


Path ; 
CESC-PRN-flat. vmdk Partition 2/NONAME [NTFS] /[root] {Users fadministrator.CLINTON/AppData/Roaming/Microsoft/Windows/Recent/export.pst.ink 


Modified 


7[23{2014 4:38:07 PM (2014-07-23 20:38:07 UTC) 11/18/2014 11:12:32 AM (2014-11-18 16:11:32UTC) 11/18/2014 11: 11:32 AM (2014-11-18 16:11:32 UTC) 


i Link target information 


‘Local Path 

|volume Type . 
‘Volume Serial Number 
‘File Size : 
‘Creation time (UTC) 
Last wate tie (UTC) 


'Last access time (UTC) 


'File attributes 
fegeniedl es ans ater eae 


‘Optional fields 
‘Relative Path 
Working directory 


'NetBIOS name 
iMAC address 


aa 4A62-8D8C 


; C:\temp\export. pst 
{Fixed Disk 


“11176830976 

7/23/2014 8:38:07 PM +00:00 | 
| 11/18/2014 4:11:06 PM +00:00 . . . 
‘17/23/2014 8:38:15 PM+00:000 0 . . 


L 


[.\.\u\..\.-\-\.-\temp\export.pst 


_. jeMtemp 
: Target system infermation 


_cesc-prn 
|00-50-56-A8-99-83 


5) HRC archive — complete.pst 
6) hrearchive@clintonemail.com — HRC archive.ost 


Registry Files: 


© Key Properties 
Last Written Time 


3/7 92015 17205157 UTC 


NTUSER.DAT\ Software\Microsoft\ Offi ce\14.0\Qutlook\Search\Catalog 


HRC-1493 


ALL INFORMATIGN CONTAINED 


From: [sd SERETH IS UNCLASSIFIED b6 
‘ATE 11-28-2016 BY g7631aTaO wSsree 

Sent time: 07/23/2014 10:19:42 PM Bie 

To: 

Subject: FedEx charge 


Hello ladies- | am not sure who deals with paying the FedEx bill, but | wanted to let you know that CESC has requested some 
work done that is requiring me to overnight them some DVDs of archived data. |am arranging a shipment now for a priority 
overnight pickup from my house tomorrow. Looks like the charge is $46.38 which can be billed to CESC. If you can put a note on 
that part of the invoice, just put “Cheryl Mills — Archive data delivery” or something to that effect. 


Thanks, and let me know if you have any questions! 


HRC-1494 


b7Cc 


Sent time: 07/24/2014 02:41:54 PM 
To: 
Subject: He used a Regular Expression text editor 


He could not recall which one he used at the time, but here is a site with some options. Can you take a look at 
these? 


http:/Avww.smashingmagazine.com/2009/04/1 0/25-text-batch-processing-tools-reviewed/ 


Doesn't look like it should take too much time (depending on the machine time).... 


-Bryan 


HRC-1495 


ALL TNECRMATIOCN CONTAINED 
BERET [5 UND LASS Pie 
DA di-2e-2016 By GibGlSTS0 BSlle 


Platte River Networks Invoice 
> 5700 Washington St 
| Date | ~—Invoice# | 


PLATTERIVER Denver, CO 80216 


networks 303.255.1941 


Bill To: 4 Q 


CESC 
Marcum LLP , 
750 Third Aven 


New York, NY 10017 


0.5 125.00 62.50 


Description 
Task/Ticket: Remote Support 
T20140812.0094 

Summary Notes: 8/12 30 min 

* Worked with Heather via phone/remote session to restore 


access to archived emails per CDM 
Resource Name 


8/12/2014 


Thank you for your business! Subtotal $62.50 


Sales Tax (0.0%) $0.00 


Total $62.50 
Payments/Credits -$62.50 


Balance Due * $0.00 


Your prompt payment is appreciated. A late fee of $25.00 and a monthly finance charge of 1 1/2% (18% 
annually) may be assessed for invoices not paid within terms. 


Any disputes should be reported within 15 days of the invoice date or all charges will be deemed as 
acceptable by the client. In the event of non-payment, the client will also be responsible for collection and 
attorney fees incurred in collections efforts. 


Please direct all billing inquiries and requests to the Accounting Department 
accounting@platteriver.com :: 303.255.1941 


HRC-1499 


b6 
b7C 


b6 
b7C 


° ALL [HEORMATION CONTAINED 
HESEIN IS JNLLASS o 
DATE 11-28-2016 BY G763l1e7s0 NSICG 


Platte River Networks Invoice 
> 5700 Washington St 
| Date | invoice# | 


PLATTERIVER Uenver, CO 80216 


networks 303.255.4 941 


Bill To: a 


CESC 
750 Third Avenue 
New York, NY 10017 


10/30/2014 
RS 


9/30/2014 Task/Ticket: Remote Support 250.00 


T20141002.0003 
Subtotal $250.00 


Summary Notes: 9/30 {| 2 hours 
Sales Tax (0.0%) $0.00 


* Export of HRC archi d PST per Cheryl Mills 
Resource Nam 
Total $250.00 
Payments/Credits -$250.00 


$0.00 


b6 
b7C 


Thank you for your business! ~ 


Your prompt payment is appreciated. A late fee of $25.00 anda monthly finance charge of 1 1/2% (18% 
annually) may be assessed for invoices not paid within terms. 


Any disputes should be reported within 15 days of the invoice date or all charges will be deemed as 
acceptable by the client. In the event of non-payment, the client will also be responsible for collection and 
attorney fees incurred in collections efforts. 


Please direct all billing inquiries and requests to the Accounting Department 


accounting@platteriver.com :: 303.255.1941 Balance Due * 


HRC-1501 


° ALL INSURRATIOCN CONTAINED 
HEREIN [5 UNCLASSIFIED 
ATE 11-28-2016 AY 276018780 HSILG 


BP Platte River Networks Invoice 


5700 Washington St 
| Date | invoice # | 


PLATTE RIVER Denver, CO 80216 
networks 303.255.1941 


Bill To: ‘40: 


CESC b6 


Marcum LLP c/ f b7C 


750 Third Avenué 
New York, NY 10017 


[Serviced Se [Units | Rate__| Amount] 


10/1/2014 Task/Ticket: Cheryl Mills phone call 0.75 125.00 93.75 
T20140929.0004 
Summary Notes: 10/1 { } 45 min 


* Call with Cheryl Mills re: HRC archive . 


b6 
b7C 


[Subtotal $9375 | [Subtotal $9375 | 75 


Thank you for your business! 


Sales Tax (0.0%) $0.00 


Total $93.75 
Payments/Credits -$93.75 


Balance Due * $0.00 


HRC-1502 


Your prompt payment is appreciated. A late fee of $25.00 anda monthly finance charge of 1 1/2% (18% 
annually) may be assessed for invoices not paid within terms. 


Any disputes should be reported within 15 days of the invoice date or all charges will be deemed as 
acceptable by the client. In the event of non-payment, the client will also be responsible for collection and 
attorney fees incurred in collections efforts. 


Please direct all billing inquiries and requests to the Accounting Department 
accounting@platteriver.com :: 303.255.1941 


ALL TNEURMATION CONTAINED 
HERETH [5 UNM LASSI PIED 
8/20/2015 Tickets by Date DA di-2e-2016 By GieeLels0 Helle 


Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), : 
Approximate round trip times in milli-seconds: | 
Minimum = Oms, Maximum = Oms, Average = Oms 


No Action required 
Hence we are closing this ticket. 


b6é 
Ss 11/19/2014 [ Notes from Service Center b7c 


Updated by Admin, Status:'‘Open’, Priority:High’, Severity:'‘Warning’, and Category:‘Onsite Manager Alerts’ 
Noc Tech:SG 


We are working on this 


; b6 
 &} 11/19/2014 [ Notes from Service Center — 


Updated by Admin, Status:Open, Priority:High, Severity:Warning, and Category:Onsite Manager Alerts 


, Remote Support : T20141118.0022 Status : Complete | 
ne me 3 : = i 


" Account Name : CESC Entered bf on 11/18/2014 | =. 
Work Type : Remote Support Currently assigned qs 


Issue Type : Service Request 
| Sub-Issue Type : 
Description : i 


(1118/2014 Administrator, 
Autotask 


b6 
1@® 1118/2014 Worked 0.50 hours (09:00 AM to 09:30 AM) | b7C 
Summary Notes : 11/18 L 30 min . 


\ * Worked with Heather via remote/phone to re-establish connection to HRC emails 


: b6 


' Site Not Communicating : T20141116.0001 Status : Complete . 


b6 


' Account Name : CESC Entered b b7c 


. Work Type : Alert Management Currently assigned t 


on 11/16/2014 


https /Avw §. autotask.net/reports/Servi ce_Desk/report/rptTicketsByDate.asp 18/30 


HRC-1503 


ALL INEORMATION CONTAINED 
BESEIN 15 JUNCLASS o 


From: aaa BATE 11-28-2516 BY G7e31eTSo HeToe bé 
b7Cc 


Sent time: 11/24/2014 07:23:45 AM 
To: PRNFirm 
Subject: MVM 


CESC has an urgent call they want me on at 8a MST so! will be on the MMM call until then 


HRC-1504 


ALL INFORMATION CONTAINED 
HEREIN I5 UNCLASSIFIEL 
8/20/2015 Tickets by Date ATE 11-28-2016 BY J76318Te0 WsIcc 


en oS 
. ; : tine ated b7C 


© 11/24/2014 Worked 2.00 hours (08:00 AM to 10:00 AM) 
: Summary Notes : 11/24 2 hours 


* Worked with Heather via phone/remote control session on more specific export requirements 


P1 - Server Has Been Rebooted : Reason Inside : T20141124.0018 Status : Complete 


Account Name : CESC Enteredb] don 11/24/2014 = 
b7c 
' Work Type : Alert Management Currently assigned qs 


; Issue Type : Monitoring Alert 
Sub-Issue Type : Alert Management 
Description : 


_ Alert has been recorded from Site: CESC for system MWNOC-L2-CESC-PRN at 11:02 AM on 11/24/2014 


Windows Event Alert was recorded 


Time: 11/24/2014 11:02:49 AM 


Windows Event Time: 11/24/2014 10:56:21 AM 
. Windows Event Log: System 
: Windows Event Source: USER32 


’ Windows EventID: 1074 


Windows Event Severity: Information 


Windows Event Message: The process C:\Windows\system32\winlogon.exe (CESC-PRN) has initiated the restart of 
computer CESC-PRN on behalf of user CLINTON\Administrator for the following reason: No title for this reason could be 
found 

Reason Code: 0x500ff 

Shutdown Type: restart 


| Comment: 

“Ej 11/24/2014 Administrator, 
Autotask 

t 

‘ E] 11/24/2014 Administrator, 

Autotask 

11/24/2014 Administrator, 

Autotask 

https /Avw5.autotask.net/reports/Service_Desk/reportrptTicketsByDate.asp 12/30 


HRC-1505 


ALL [PE PCRD ATION CONTAINED 
HEBE IT [5 UNULASSIP IE) 
UATE ll-28-2016 By J /Geleleo As 


11/24/2014 10:23 AM|PRN Admin Server 


11/24/2014 10:24 AM|PRN Admin Server 
11/24/2014 10:29 AM|PRN Admin Server 


11/24/2014 10:51 AM|PRN Admin Server 
11/24/2014] 10:55:11 AM|PRN Admin Server 


Outlook Office Alert event log on the PRN Admin Server indicates 
sure you want to remove this mailbox?" 
Microsoft Outlook configuration files [HRC archive.srs, HRC archive.xml, PB45- 
Configuration-hrcarchive@clineontemail.com.xml files) associated with 
archive were MODIFIED on the PRN Admin server under the 
“administrator.CLINTON" profile. 

Outlook Office Alert event log on the PRN Admin Server indicates "The 
subfolders will also be deleted. Are you sure you want to delete the "ZOV 
export’ folder? 
NTUSER.DAT Windows registry key for the "administrator.CLINTON" 
"\Software\Microsoft\Office\14.0\Outlook\Search" containing 
“hrcarchive@clintonemail.com-HRC archive.ost" was updated on PRN Admin 
Server. 


“Are you 


profile, 


Users\administrator.CLINTON\AppData\Local\Microsoft\Outlook PF 
@gmail.com temp.pst.tmp created timestamp 


Users\administrator.CLINTON\AppData\Local\Microsoft\Outlook\ 
temp.pst.tmp accessed/modified timestamp 


PB4S-Configuration-hrcarchive@clintonemail.com.xml on PRN Admin Server is 


11/24/2014 10:55:13 AM/PRN Admin Server 
MODIFIED. File contains "protection" rules for email rights management (who 
11/24/2014 11:01 AM|PRN Admin Server __|can forward types of emails, access for replies). 


Shortcut file "huma-gmail-yahoo.pst.Ink" is CREATED on the PRN Admin 
HRC Archive.xml (Outlook navigation pane settings data file) is MODIFIED on 


CG 


HRC-1506 


b6 
b7C 


b6 
b7C 


ALL [NSUORSATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-28-2016 BY G76g187eO Nelle 


PRN Admin Server — PST Files 


Profile: administrator.CLINTON 


“HRC Archive” referenced in the Windows Messaging Subsystem profile fo__|temp: ee 
© Key Properties 
Last Written Time 1/6/2015 15:01:15 UTC 
NTUSER.DAT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystern\Profiles| lternp\! b6 
ay eee Eee Pe ee ee Sa fs eee SS ng ee Fears = ee eee b7c 
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HRC-1507 


ALL [NSURDAT ION CONTAINED 
Hessel TS UG CLASSIF IED 
UATE lle ge s0lL6 By GVGGlLeTeO Nall: 


Subrnt 

From Me 

Resend 

Sender Email Address 

Sent Representing Emad Address 
Send Representing Name 

Read Receipt Requested 
Message Cliss 

Message Sze 

Received By 

Received Representing Errail Address 
Conversation Topic , 
Received By Emad Address 
Importance 

Sensitivity 

Received Representing Name 
Last Modifier Name 

Sender Name 

Entry D 

Internet Message ID 
Canveraatinn Indav 


Fake 

Fabe 

Fase 

remesp Istete.gov 
reinespGrtste gov 
Rennes, Fhifape | 
False 


Kanal 
Nomal 


| 


ERC Archive 


Rexes Briicoe i 


b6 
b7c 


b6 per DOS 
b7E per DOS 


HRC-1508 


b6 


From: 

Sent time: 12/10/2014 01:38:13 PM BIC 
To: HDR29 <HOR29@clintonemail.com> 

Subject: RE: test 

Reply #2 


From: HDR29 [mailto: HDR29@clintonemail.com] 


Sent: Wednesday, December 10, 2014 2:36 PM 
b7c 


Subject: Re: test 


Success 


Date: Wednesday, December 10, 2014 at 2.34 PM bic 


To[L__khdr29 clintonemail.com> 
Subject: RE: test 


reply 


From: HDR29 [mailto: HDR29@clintonemail.com] 


Sent: Wednesday, December 10, 2014 2:33 PM 
To: 
Subject: test 


b6 
b7c 


test 


SSS SS ee ee 


This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit http:/Awww.mimecast.com 


—__——_--eerownra ss 


HRC-1513 


From aaa 


Sent time: 12/10/2014 01:34:57 PM 

To: HDR29 <HDR29@clintonemail.com> 
Subject: RE: test 

reply 


From: HDR29 [mailto:HDR29@clintonemail.com] 
Sent: Wednesday, December 10, 2014 2:33 PM 
To 

Subject: test 


test 


b6 
b7c 


b6 
b7C 


HRC-1515 


From: 


Sent: Frida 12, 2014 1:40 PM 
Subject: : Aro 


Does the BB have any field to change the display name? | am not finding anything on this topic so far 


Sent: Friday, December 12, 2 : M 
Tof 


Subject: Re: hrod17 


Hal 


From 

Date: Friday, December 12, 2014 at 1:28 PM 
To 

Subject: RE: hrod17 


| will look into this. All bets are off with Exchange and IMAP however! 


From[ mai 
Sent: Friday, December 12, 2014 1:18 PM 
To | 


Subject: Re: hrod17 


It worked! Thank you! 


b6e 
b7C¢ 


be 
b7Cc 


b6 
b7Cc 


b6 
b7Cc 


it's showing up as from “clinton/hdr29@clintonemail.com” - and we don’t see an option on our end to change 
that on the berry. Is that something that gets done by you or through the web portal? We just want it to say “H" 


From: 


Date: Friday, December 12 14 at 12:44 Pm 
To| | 


Subject: RE: hrod17 


Phone is going to be a problem, | have a conf call at 1p EST and then I’m in the car directly afterwards. 


Have you tried Clinton\hdr29 and hdr29@clintonemail.com for the username? 


| just changed the authentication type for IMAP on the server, can you try it again real quick? 


Sent: Friday, December 12, 2014 12:41 PM 
To 
Subject: Re: hrod17 


b6 
b7c 


b6 
b7c 


HRC-1516 


Just saw it - thank you. 


b6 
Can I call you wit bn the line, who has the device in hand and bringing it to HRC - because we b7C 
can not crack the IMAP code. If so, let me know where to call you. 


b6 
b7Cc 


Subject: RE: 17 


It should be starting to populate now 


: — b6 
rrom{_____tmat] —] 7 
Sent: Friday, December 12, 2014 12.32 PM 
To 
Subject: Re: hrod17 


Let me know when | should look to see if it’s populating. 


i eres) Bie 
Date: Friday, December 12, 2014 at 11:52 AM 

; cna 

Subject: RE. hro 

Can do 


noe Original Message----- b6 
Sent: Friday, December 12, 2014 11:47 AM 
tof] 


Subject: hrod17 


You can put a copy of her last 60 days of email received in hrod17 into her hdr29@clintonemail.com account right? Same 
concept as copying her contacts over. That way she has the last 60 by virtue of the hdr29 account. 


This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit http:/Awww.mimecast com 


’ 


This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit htto:/Avwww.mimecast.com 


—_——_—— CO eee 


This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit http:/Awww.mimecast.com 


Sr 
> -C.rorOrO eee 


2 
HRC-1517 


ALL INFORMATION CONTAINED 
8/20/2015 Tickets by Date HEREIN IS UNCLASSIFIED 
UATE 11-28-2016 BY J76318TS0 NSICG 


Issue Type : Service Request 
Sub-Issue Type : 
. Description : 


‘EP 12/11/2014 Administrator, 
Autotask 


| b6 
12/09/2014 
'& ae ts “ Lo hn i . anaes b7c 


b6 
O) 12/09/2014 Worked 0.50 hours (01:00 PM to 01:30 PM) b7c 


Summary Notes : 12/9 30 min 
* Phone call with CDM and Heather about upcoming changes/email archive 


| P1 - VMware ESXi Trap Messages : T20141208.0017 Status : Complete ' 


, Account Name : CESC Entered bf don 12/08/2014 ae 
, Work Type : Alert Management Currently assigned qs 


Issue Type : Monitoring Alert 
Sub-Issue Type : Alert Management 

{ 
Description : 


Alert has been recorded from Site: CESC for system MWNOC-L2-CESC-ESXi.clinton.local at 9:54 AM on 12/8/2014 


SNMP Trap Alert was recorded 
Time: 12/8/2014 9:54:04 AM 
' Generic Message: EnterpriseSpecific 
Enterprise OID: 1.3.6.1.4.1.6876.4.1 
Specific Number: 3 
| Varbind #1: OID: 1.3.6.1.4.1.6876.50.101.0 Data: 3 


' Varbind #2: OID: 1.3.6.1.4.1.6876.50.102.0 Data: /vmfs/volumes/51ba449f-a875f9ee-a00e- 
| 90b11¢51b4f4/cintinetbb/cintinetbb.vmx 
t 


' Varbind #3: OID: 1.3.6.1.4.1.6876.2.1.1.2.10 Data: CLNTINETBB (BES) ! 


12/08/2014 Administrator, 
Autotask ; 
' } 12/08/2014 Administrator, 
| Autotask 
hitps /Avw 5.autotask.net/reports/Servi ce_Desk/report/rptTicketsByDate.asp 5/30 


HRC-1518 


ALL INSURRATIOCN CONTAINED 
HEREIN 15 UNCLASSIFIED 


From: ATE 11-22-2016 BY oyeclsYeo yeice 

Sent time: 12/11/2014 09:35:38 AM bé 

To: pyc 

Subject: RE: 2 items for IT support 

| look forward to it. I’m kind of freaking about Gresham. Thoughts on what to do wit _| b6 
b7c 


From 


Sent: Thursday, December 11, 2014 8:33 AM 
To 


Subject: RE: 2 items for IT support 


Its all part of the Hilary coverup operation © |’ll have to tell you about it at the party 


From[___ BS 


Sent: Thursday, December 11, 2014 10:26 AM bic 
Subject: RE: 2 items for IT support 

Shit. Thanks for the heads up. 

From b6 
Sent: Thursday, December 11, 2014 8:25 AM bic 
T 

Subject: RE: 2 items for IT support 

1am stuck on the phone with cesc again 

From b6 
Sent: Thursday, December 11, 2014 10:09 AM b7c 
To 


Subject: FW: 2 items for IT support 


I’ve got the IOC in a meeting. can you take this one? 


Fonsi id b6 
Sent: Thursday, December IT, ; b7c 
To: of helpdesk 

Subject: RE: 2 items for IT support 


| cannot access the CRM nowat all. 


b6 
b7Cc 
Gresham Partners, LLC 


333 W. Wacker Dr., Suite 700 | Chica IL 
a | eT 


From: IOC (mailto: IOC@platteriver.com 
Sent: Wednesday, December 10, 2014 5:33 PM 


To; helpdesk b6 
Cc b7C 
Subject: RE: 2 items for IT support 


[ 


You should have access to the Project Planning folder now. Please test and let us know. 
As for 1E11 — did we want to hold off given the recent CRM issue with IE11? 
We can also help with the toolbar tomorrow whenever you have a few minutes to let us remote onto your machine. Please let 
us know when would be a good time to do that. Thanks! 
HRC-1519 


303.255.1941 
INTUITION OPERATIONS CENTER 


PLATTE RIVER NETWORKS 


ITSERVICES FOR BUSINESS 


Front | mailt 

Sent: Wednesday, December 10, 2014 1:18 PM 
To: helpdesk 

Cec: 

Subject: 2 items for IT support 


Would you please giv{___hccess to this folder S:Project Planning 
Also[ reeds IE 11. She is using Chrome to access files from the SEC site, but she keeps getting the google toolbar 


Thank i 


Gresham Partners, LLC 


333_W. Wacker Dr., Suite 700 | Chicago, IL 60606 
| fs <==] 


Gresham Partners is an independent investment and wealth management firm that has been serving select families, 
family offices and endowments since 1997. 


Please visit www.greshampartners.com to learn more about Gresham. 


This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit http:/Awww.mimecast.com 


HRC-1520 


b6 
b7c 


be 
b7C¢ 


be 
b7Cc 


b6é 
b7¢ 


ALL INEORMATION CONTAINED 
BESET IS JNCLASS uo 


8/20/2015 Tickets by Date 


: Summary Notes :12/22{___} 4 hours 
* Server maintenance 12/22 


eer ae 
| CESC - email changes : T20141212.0040 


, Account Name : CESC Enteredbf on 12/12/2014 
Work Type : Helpdesk Currently assigned qs 


Issue Type: | Service Request 
: Sub-Issue Type : 


Description : 


| 
12/14/2014 Administrator, 
, Autotask 


' 


I 1212/2014 a Worked 2.00 hours (09:00 AM to 11:00 AM) 


Summary Notes : 12/12 2 hours 
* Email retention changes per Cheryl Mills 


* Archive/email p tasks 
* Worked wit lion IMAP access settings 
"Remote Support : T20141211.0028 


Account Name : CESC Entered bf ibn 12/11/2014 


| Work Type : Remote Support Currently assigned 


‘ Issue Type : Service Request 
" Sub-Issue Type: 
' Description : 


‘(3 12/11/2014 Administrator, 
: Autotask 


https /Avw 5.autotask net/reports/Service_Desk/report/rptTicketsByDate.asp 


Status : Complete 


Status : Complete . 


2/30 


HRC-1521 


DATE 11-28-2016 By G760187S0 NSICG 


be 
b7c 


be 
b7C¢ 


be 
b7Cc 


b6 
b7Cc 


b6 
b7Cc 


be 
b7c 


8/20/2015 Tickets by Date 


' b6 
© 01/05/2015 Worked 0.50 hours (12:00 PM to 12:30 PM) b7c 
Summary Notes : 1/5 30 min 


* Remote session with Cheryl and Heather to clean up files | 


https :/Avw 5.autotask .net/reports/Service_Desk/report/rptTicketsByDate.asp 19/19 


HRC-1522 


ALL IUZUSRATION CONTAIUED 
HEREIN TS UN LASSI FIED 
UATE llege 2016 Bi GVGuleTeb NeIlG 


HRC-1523 


SLL IN@ORMATION CONTAINED 
HEREIN IS UN CLASS a 


PRN Admin Server — PST Files DATE 11-28-2016 BY J76318TS0 WSICC 


Profile: administrator.CLINTON 
PST files referenced in OpenSave Most Recently Used PST and the Recent Documents registry keys: 


e HRC .gov email Archive.pst 
® HRC .gov emails.pst 

@ HRC gov emails.pst 

@ export.pst 


18 Key Properties 
: Last Written Time 1/6/2015 15:02:16 UTC 


RTUBER,DAT\ Software\Microsoft\Windows\CurrentVersion\Explorer\ComDIg32\OpenSavePidIMRU\pst _ 


© Key Properties 
Last Written Time 1/6/2015 15:02:16 UTC 


NTUSER.DAT\Software\Microsoft\Windows\C urrentVersion\Explorer\RecentDocs\pst_ 


HRC-1524 


From: 

Sent time: 01/07/2015 03:37:03 PM 
To: 

Ce: CRC 

Subject: RE: Active User List 


ALL DTNEORMATICN UCN TAINED 
HEREIN [5 URCLASSIZIEU 
DATE 11-25-2016 BY J/50187T80 Haice 


The highlighted items are confirmed active mailboxes. 


CCM 


ffice Scheduling 


Finances ffice 


H 


Helpdesk (unaware of this account, | assume it is the admin account) 
HRC Archive 
Huma Abedin 


| 


Justin Admin2 
Justin Cooper 


should be forwarding to a gmail.com account) 


Press 


who requested this account?) 


(should be forwarding to a clintonfoundatian.org account) 


Thanks 


Clinton Foundation 
rect} 


1 
Sent: Wednesday, January 07, 2015 3:18 PM 
To| 


Ce: CRC 
Subject: RE: Active User List 


At your convenience, can you please forward over the current user list. 


Thanks, 


aah 
T REPRESENTATIVE | CRC 


HRC-1525 


b6 
b7c 


b6é 
b7¢ 


b6 
b7c 


b6 
b7c 


b6 
b7c 


b6 
b7Cc 


PLATTE RIVER 


networks 


Fro 

Sent: Fri 

To 

Subject: RE: Active User List 


723 PM 


ALL [Ne UbIss 


= JaC 


TO Cou 


ASSIS LED 


HEREIN 


ALTEL 


DATE ll-26-2016 Bx G7GGL87eD Nell: 


| think we disabled justin’s accounts but never fully removed them, | will get that done 


There are no forwards of _pccount. Should that be deleted as well ? 


Fro mailt 


Sent: Friday, December 5, 2014 3:09 PM 


To 
Subject: RE: Active User List 


Thank | 


[faa she has requested last year for the Justin accounts to be deleted. 


Also, what currently happens wef —sSCSCSCids emailed? Is the mail being forwarded 


anywhere? 


Thanks, 


Clinton Foundation 


Direct 


Sent: Thursday, December 04, 2014 6:31 PM 


) TTT 


Subject: RE: Active User List 


[_here is the current list of mailboxes on the server (mailboxes only, not distribution groups) 


_ 


CCM 


ffice Scheduling 


Finances 
H 


helpdesk 
HRC Archive 
Huma Abedin 


|| 


Justin Admin2 
Justin Cooper 


_ 


HRC-1526 


b6 
b7c 


be 
b7C¢ 


b6é 
b7Cc 


b6 
b7c 


be 
b7C¢ 


b6 
b7c 


b6 
b7c 


Press 


From{___ | 


Sent: Thursday, December 4, 2014 6:26 PM 
To 

Cc 

Subject: RE: Active User List 


This was the list that was sent to me roughly 6 months ago or so. Copied] _ i he has any other insight 


| CLIENT RESOURCE REPRESENTATIVE 
O 303.255.1941 F 303.474.3942 


PLATTE RIVER NETWORKS 


IT SERVICES FOR BUSINESS 


From{ mailto 

Sent: Thursday, December 04, 2014 4:19 PM 
To 

Subject: RE: Active User List 


a 


Are we sure this list is complete? What jumps out to me, if ds not listed. 


finton Foundation 
rec 


From iat 


Sent: Thursday, December 04, 2014 12:27 PM 
To: 

Ce: 

Subject: RE: Active User List 


ae 


Is that list accurate or do we need to add/delete anyone? 


Thanks, 


CLIENT RESOURCE REPRESENTATIVE 
O 303.255.1941 F 303.474.3942 


PLATTE RIVER NETWORKS 


IT SERVICES FOR BUSINESS 


From: 

Sent: Wednesday, December 03, 2014 8:03 AM 
To: 

Subject: RE: Active User List 


Please see attached 
| CLIENT RESOURCE REPRESENTATIVE 


© 303.255.1941 F 303.474.3942 
PLATTE RIVER NETWORKS 


HRC-1527 


b6 
b7Cc 


b6e 
b7c 


b6 
b7c 


be 
b7Cc 


b6 
b7c 


be 
b7c 


be 
b7c 


be 
b7Cc 


be 
b7C¢ 


b6é 
b7C 


b6 
b7c 


IT SERVICES FOR BUSINESS 


Fromf mailto 

Sent: Tuesday, December 02, 2014 4:51 PM 
To 

Subject: RE: Active User List 


Yes, | would still need them. Tomorrow is fine. 


Thanks 


inton Foundation 
Direc! 


From{_ | mailt 

Sent: Tuesday, December 02, 2014 6:50 PM 
To 

Subject: RE: Active User List 


b6 
b7C 


b6é 
b7¢ 


be 
b7c 


{ can, let me send this to you tomorrow as ! will have to go into each user’s account. This has no effect on their actual account, 


this is just for our records only. Still need me to send the email addresses over? 


| CLIENT RESOURCE REPRESENTATIVE 
O 303.255.1941 F 303.474.3942 


PLATTE RIVER NETWORKS 


IT SERVICES FOR BUSINESS 


Sent: Tuesday, December 02, 2014 4:46 PM 
td 


Subject: RE: Active User List 


; 


Can you please send me the email address associated with the accounts. 


Clinton Foundation 
rec 


Sent: Tuesday, December 02, : 


To 
Cc; 
Subject: Active User List 


L 


b6e 
b7c 


b6 
b7Cc 


be 
b7C 


be 
b7c 


b6 
b7c 


b6 
b7c 


Below is the Active User List that | have in our system. Can you please go through this list and let me know if any of these users 
are no longer with your organization or if there are any users | need to add to this list? Please send me an update at your 


earliest convenience. Thanks!! 


HRC-1528 


Justin Cooper 
Justin Admin2 


Huma Abedin 


Ld 


H*® 


| CLIENT RESOURCE REPRESENTATIVE 
O 303.255.1941 F 303.474.3942 


PLATTE RIVER NETWORKS 


ITSERVICES FOR BUSINESS 


This email has been scanned for email related threats and delivered safely by Mimecast. 


For more information please visit http://www.mimecast.com 
ee ee 


a a 
This email has been scanned for email related threats and delivered safely by Mimecast. 


For more information please visit http://www.mimecast.com 
i he 


es es 
This email has been scanned for email related threats and delivered safely by Mimecast. 

For more information please visit http://www.mimecast.com 
a 


SSS 
This email has been scanned for email related threats and delivered safely by Mimecast. 

For more information please visit http:/Awww.mimecast.com 
Se a a Et 


SESE 
This email has been scanned for email related threats and delivered safely by Mimecast. 

For more information please visit http:/Avwww.mimecast.com 
eee 


HRC-1529 


b6 
b7C 


b6 
b7Cc 


PRN Admin Server - Installed/Uninstalled Application Events: 


_ Event 1D 


11,724] 
11,724 
11,728: 
11,707 
11,707, 
11,728 
11,728 | 
“14,728 
11,707! 
11,728 
11,728! 
11,707 
11,707" 
11,707 
11,728: 
11,707 
11,707: 
11,707 
11,707 
11,707 
11,728. 
11,707 
11,707" 
11,724 
11,707) 
11,728 
11,707" 
11,707 
11,707- 
11,707. 
41,707 
14,707 
41,707: 


Time Generated sip 
40/1/2015 11:28:50 PM S-2-5-21-21466 71 152-126353846 5-33 10924795- 1643 
10/1/2015 11:28:41 PM $-1-5-21-2146671152- 1263538465-33 1092479 5-16-43 
9/25/2015 10:42: 14 AM’ S-1-5-21-2146671 152-1263538465-3310924795- 1643 
9/25/2015 10:38:42 AM S-1-5-21-2146671152- 126353846 5-33 1092479S- 1643 
9/25/2015 10:38: 09 AM! 5-1-5-21-2146671 152-1263538465-3310924795-1643 
9/25/2045 10: 33: 09 AM S-~1- -5-21-21466 71 152+ 126353846 5-3310924795- 1643 
9/25/2015 10:38:09 AM * §-1-5-21-2146671152-1263538465-3310924795-1643 
9/15/2015 4:49:00 PM S-1-5-18 
9/10/2015 2:01:40 AM S-1-5-18 
8/25/2015 10: 42:00 PM S-1-5-18 
8/17/2015 12:36: 00 AM 'S-1-5-18 
6/9/2015 10:56:22 AM S-1-S-18 
6A/215 1:03: 19 AM 5-1-5-18 
5/25/2015 6:32:14PM S-t-5-18 
5/15/2015 1:30:00 PM S-1-5-18 
5/11/2015 10:24:55 AM S-1-5-18 
5/6f2015 6:25:09 AM S-1-5-18 
4/52015 1:24:36 AM S-1-5-18 
9f2f2015 10:24:26 PM S-1-5-18 
3/26/2015 9:24:57 AM S-1-5-18 
2/26/2015 4:15:42 PM , S-1-5-21-2146671 152-1263538465-33 10924795-1643 
2/5/2015 9:24:00 AM S-1-5-18 : 
1/26/2015 2:41:17 PM S-1-5-21-2146671 152-1263538465-3310924795-S00 
1/23/2015 11: 51:04AM S-1-5-18 
1/8/20 15 9:19:51 PM | S-1-5-18 
1/5/2015 3:31:33 PM $-1-5-21-2146671152-1263538465-33 10924795-S00 
4/5/2015 3:31:13 PM S-1-5-21-214667 1 152-126353846 5-33 10924795-S00 
1/5f20:15 3:30:38 PM S-1-5-21-2146671 152-1263538465-33 10924795-S00 
1/5/20 85 3:30:37 PM | S-1-S-21-2146671152-126353846S-33 10924795-500 
1/5/2015 3:30:33 PM ‘S-4-5-21- -2146671152-1263538465-33 10924795-500 
1/5/2015 3:29: 47 PM‘ S-1-5-21-2146671 152-1263538465-3310924795-500 
1/5/2015 3:29:46 PM S-1-5-21-2145671 152-1263538465-3310924795-S00 
1/5/2015 3:29:26 PM, S-1-5-21-2146671152-1263538465-33 10924795-S00 


ALL [NECRIAT ION CONTAINED 
Heese IN TS UP CLASS a 
DBTE lle se 2016 Be oyGCl eeu NS 


Message 
Product: ScreenConnect Client (aa0488eadb 28Sdb 1) ~ Removal completed successfully. 
Product: ScreenConnect Client (S6cfa98e32ea8 13a) — Removal completed successfully. 


' Product: Ontrack PowerControls 7.2 -- Configuration completed successfufty, 


Product: Ontrack PowerControls 7.2 ~ Installation operation completed successfully. 

’ Product: Ontrack PowerControls 7,2 ~ Installation operation completed successfully. 

Product: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 — — Configuration completed successfully 
. Product: Microsoft Visual C++ 2005 Redistributable — Configuration completed successfully, 

Product: Google Update Helper — Configuration completed successfully. 

Product: ScreenConnect Client (aa0488eadb285db 1) ~ Installation completed successfully. 

Product: Google Update Helper ~ ~ Configuration completed successfully. 


‘ Product: Google Update Helper ~ Configuration completed successfully. 


Product: SceenConnect Clent (SécfaS8e32ea8 13a) ~ Installation completed successfully. 


' Product: SoeenConnect Client (Sécfa9¢e32ea8 133) ~ Installation completed successfully. 


Product: Google Apps Sync" for Microsoft Outlook® 3.7.410. 1100 ~ Installation completed successfully. 
Product: Google Update Helper — Configuration completed successfully. : 
Product: Google Apps Sync" for Microsoft Outlook® 3.7.40, 1050 ~ Installation completed successfilly. 


‘ Product: Google Apps Migration For Microsoft Outlook® 3.4.27.52 ~ Installation completed successfully. 


Product: Google Apps Sync™™ for Microsoft Outlook® 3.7.395. 1040 -- Installation completed successfully. 
Product: Google Apps Migration For Microsoft Outlook® 3.3.25. 50 -- Installation completed successfully. 
Product: Google Apps Migration For Microsoft Outlook® 3. 2.23.49 — Installation completed successfully. 
* Product: Trend Micro Client/Server Security Agent ~ Configuration completed successfully. 

‘ product: Google Update Helper -- Installation completed successfully. 

Product: FortiCient SSLVPN v4.0.2300 — Installation completed successfully. 

Product: Managed Workplace Onsite Manager — Removal completed successfully. 

Product: Google Apps Migration For Microsoft Outlook® 3, 1.21.46 — Installation completed successfully. 
Product: Ontrack PowerControls 7.2 -- Configuration completed successfully. 

Product: Ontrack PowerControls 7.2 ~ Installation operation completed successfully. 

Product: Ontrack PowerControls 7,2 -- Installation operation completed successfully. 


, Product: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729. 17 ~ Installation completed successfully. 


Product: Microsoft Visual C-++ 2005 Redistributable — Instaation completed successfully. 


; Product: Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 ~ Installation complated successfully. 
‘Product: Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0,60610 ~ Installation completed successfully. 
: Product: Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729. 17 ~ Installation completed successfully. 


HRC-1530 


ALL INECRMATION CONTAINED 
HERE TH IS IN LASSIF IED 
From: [se DATE ll-28-2016 Bx g/GgleTeD Nelle bé 


Sent time: 03/05/2015 12.31.29 PM . bic 
To: 
Subject: Security Pursuit 
[]s going to send over a list of recommendations for us to apply for additional security against hackers. b6 
He did say we should probably remove all Clinton files, folders, info off our servers etc. on an independent drive. b7c 
b6 
b7C 


2955 INCAST 2K 0: 303.255.1941 
DENVER, CO 80202 M: 303.253.0386 
WWW.PLATTERIVER.COM 


INGRAM 
PeicROp 


Dacizes tart 
‘Cunt teem J On te 


Bama tape 
we ms 


HRG- 1531 


ALL INSUORSATION CONTAINED 
HEREIN IS UNCLASSIFIED 


[fs ce. = = 41 CATE 11-22-2016 8. 2 6 018 80 Hell; b6 
From: 


Sent time: 03/03/2015 09:11:16 AM Bie 
To: 
Subject: ' RE: top story in the news today... 
Not surprised. 
b6 
b7Cc 


PLATTE RIVER NETWORKS 
2955 INCAST 2K 0: 303.255.1941 


DENVER, CO 80202 M: 303.253.0386 
WWW.PLATTERIVER.COM 


CRN SMB ke: 
wa £ Bat NS A 
= fast S03 500 150 


| eco 


[MICROM 


Paetuat baat 
aw Ros oe ee 
oon 


a ss 
Sent: Tuesda arc 2015 8:11 AM b7c 


To 
Subject: RE: top story in the news today... 


I've done quite a bit already in the last few months related to this. Her team had me do a bunch of exports and email filters and cleanup 
to provide a PST file of all of HRC’s emails to/from any .gov addresses. I billed probably close to 10 hours in oncall tickets with CESC 
related to it :) 


From b6 
Sent: : b7C 
To 
Ce 
Subject: RE: top story in the news today... 
I’m curious the questioned emails actually reside on the new server we provisioned. 
We may be asked to provide those. Can’t imagine it will be much more than that. 
b6 
b7c 


PLATTE RIVER NETWORKS 
2955 INCAST 2K 0: 303.255.1941 


DENVER, CO 80202 M: 303.253.0386 
WWW. PLATTERIVER.COM 


ae CRN nar MEN) inverass 
mine ff saw ie oxo; SMB a) icROm 
“oS ot : . 5 ewteme one we 


1 Geren Rene co a 
oa, 


From b6 


Sent: Tuesday, March 03, 2015 7:56 AM b7C 
T 
Cc 


Subject: RE: top story in the news today... 


Guess we'll have to wait and see if we are asked to do anything. 


From b6 
Sent: Tuesday, March 3, 2015 7:45 AM me 
To 

Cc 


Subject: top story in the news today... 


HRC-1532 


We should probably discuss what if...regarding Hillary and the state department emails. 
| know we did not take over email until AFTER the mentioned occurrence. 


| assume some of those emails may have been migrated when we took over? b6 
b7C 


2955 INCAST 2K 0: 303.255.1941 
DENVER, CO 80202 M: 303.253.0386 
WWW. PLATTERIVER.COM 


Si iB r HUW) iyerana 


CRN a 
& ier * WEXP-GEN —— 
= FT 0S BB ten 


y 
: 


HRC-1533 


ALL [NEOGRMATION CONTAINED 


—_aes; ee b6 
Brom: DATE 11-28-2016 BY J76JieTe0 WSICG |W, 
Sent time: 03/05/2015 05:29:17 PM 
To: 

Subject: RE: Share 


Works for me. 


b6 


From 
b7C 


Sent: Thursday, March 5, 2015 4:28 PM 
ee 
Subject: RE: Share 


Is this accurate on who needs access? 


b6 
b7C 
LATTE RIVER NETWORKS 


2955 INCA ST 2K | DENVER, CO 80202 
303.255.1941 | PLATTERIVER.COM 


From b6 
Sent: Thursday, March 5, 2015 9:41 AM b7Cc 
fd 
Subject: Share 
I've created a new share 
\\prndc01\cesc$ 
Who all needs access to that share? Currently | have the following: 
b6 
b7C 
Any others that would need access? I’ve completed downloading the notes from Evernote and deleted out of our Evernote 
account. | will move the P: drive files there next. 
Thanks, 
b6 
b7C 


PLATTE RIVER NETWORKS 
2955 INCA ST 2K | DENVER, CO 80202 


303.255.1941 | PLATTERIVER.COM 


Y PLATTE RIVER 


networks 


HRC-1534 


ALL INPUORSATION CONTAINED 


HEREIN IS UNCLASSIFIED b6 
From: Ld DATE 11-28-2016 BY J76J18T80 NSICG | _ 
Sent time: 03/05/2015 05:34:49 PM 
To: 
Ce: 
Subject: Share 


I've created a share \\prndcO1\cesc$. You should all have access to the share and folders. | moved the P: drive client files and 
dumped all the notes from Evernote in the share. You will need to access this for the time being for any of the documentation. 


Please let me know if you have questions. 


b6 
b7C 


PLATTE RIVER NETWORKS 
2955 INCA ST 2K | DENVER, CO 80202 


303.255.1941 | PLATTERIVER.COM 


PLATTE RIVER 


networks 


HRC-1535 


ALL INPUORSATION CONTAINED 


HEREIN IS UNCLASSIFIED ie 
From: Lo] DATE 11-28-2016 BY J76J18TEO NSICG | — 
Sent time: / 55: 
To: 
Subject: RE: CESC Firewall 


I'd have to check my email, but I’m pretty sure they required HRC’s backup device to be able to hit the mail server via 
IMAP/SMTP after they moved her address (they had me forward her email to another server a month or two back) 


_ ac 
i Bre 


Sent: Thursday, March 5, 2015 9:52 PM 
T eee 


Subject: CESC Firewall 


So after | locked things down this morning, | went back in and found we have a rule allowing any IP on the internet inbound to 
the mail server over ports 25, and 465 (SMTPS). I didn’t see much traffic hitting it, and | assume all traffic has to go through 
MXLogic, so | disabled it. If we get any calls about email not coming through or something, we can just re-enable it. Unless you 
know of any reason why we left this rule in place? 


b6 
b7C 


303.255.1941 


PLATTE RIVER 


networks 


HRC-1536 


ALL INSORRATION CONTAINED 
HEREIN Is UNCLASSIFIED 
4) export.pst DATE 11-28-2016 BY J76318 780 Helle 


Path : 
CESC-PRN-flat. vmdkPartition 2/NONAME INTFS] [root] Users administrator CLINTON/AppData/Roaming/MicrosoftAvindows/Recent/export.pst. ink 


Modified 


7{23]{2014 4:38:07 PM (2014-07-23 20:38:07 UTC) 11/18/2014 11:11:32 AM (2014-11-18 16:11:32UTC) 12/18/2014 11:11:32 AM (2014-11-18 16:11:32 UTC) 


‘Link target information — | 
Local Path 'C:\temp\export.pst . . 

Volume Type ened Disk 
[Volume Serial Number _'4a62-808C itty a ee i Oe 
Et ee IE ee ag ae 
foe time (UTC) 7/23/2014 8:38:07 PM +00:00 : egress 
astra me (ure) |uvaefore sritoeem oon 
jtast access time (UTC) | 7/23/2014 8:38:15 PM +00:000 aks 7 

File attributes 

Optional fields 

Relative Path : |..\..\.\.-\..\.-\..\temp\export.pst 

Working directory === {c:\temp .. : ; ten ee 

| Farget system information a ie | 
| NetBIOS name ,cesc-pm 

|MAC address leaseuse-ae sores ; 


5) HRC archive — complete.pst 
6) hrcarchive@clintonemail.com — HRC archive.ost 


Registry Files: 


1& Key Properties 
Last Written Time ie : (03:37 UTC 


NTUSER.DAT\Software\Microsoft\ Office\14.0\Outlook\Search\Catalog 


HRC-1537 


ALL INFORMATION CUNTAINEL 
HEREIN [5 UNCLASSIFIED 
8/20/2015 Tickets by Date a il -28-2016 Bl g/6clsiTeo Nelco 


'@ 03/08/2015 Worked 13.00 hours (01:00 PM to 02:00 AM) | = : 
; Summary Notes : 3.8.1 PRN (1:00p — 2:00a) 13hrs On Call 


* Talked with Cheryl about some questions/concerns she had. 
* Decided we cannot answer the email backup questions accurately without physically being onsite. 

* Reviewed available flights, and booked one for a few hours from now. 

* Headed to the airport and arrived in NYC. 

*Gotin a car and headed to the Datacenter. 


* Called Cheryl and reviewed what we will be looking for. b6é 
* Worked wittl ko ensure we have all backups and files we think we have, and re-inventoried all data. 7 
* Powered on the older servers that have been shutdown and looked for any backups or old data, did not find Bie 


anything. i 
“Reviewed the old drives and didn't find anything either. 

* Double checked the physical security and cabling, and had another call with Cheryl. 
* Headed back to the hotel and continued security measures. 


b6 
® 03/07/2015 Worked 4.00 hours (10:00 AM to 02:00 PM) aes 
; Summary Notes : 3/7 4 hours 


* Security updates, conference calls, plannin 
g 


b6 


[|B setup : T20150303.0045 Status : Complete | b7c 


Account Name : CESC Enteredby jon 03/03/2015 =a 


' Work Type : Remote Support Currently assigned qd 


' Issue Type : Service Request 
Sub-Issue Type : 
_ Description: 


03/04/2015 Administrator, 
Autotask 


i / b6 


© 03/03/2015 Worked 0.50 hours (12:00 PM to 12:30 PM) 


Summary Notes : 3/ 30 min 


Fa b6 
* Provision/setup of new BB account fo 
Pp L_] Ee b7C 


Webroot : T20150226.0029 Status : Complete ! 


: b6 
, Account Name : CESC Entered b n 02/26/2015 bic 
Work Type : Remote Support Currently assigned t 
: Issue Type : Service Request 
_ Sub-Issue Type : 


Description: 


https /Avw 5. autotask.net/reports/Service_Desk/report/rptTickets ByDate.asp 16/19 


HRC-1538 


ALL INECRMATION CONTAINED 
HERETH IS UN CLASSIFIED 


H . DATE L1-28-2015 By J7SCLETSGE HSL: 
USB Devices — PRN Admin Server 


SerlalNumber —'FriendlyName 1 ns 4 7 
0000000F ASABE0&0|USB 2.0 USB Flash Drive USB Device |administrator.CUINTON, prnadmin.CLINTON ; 3/8/2015 23:21 9/30/2015 21:03 
0000000F ASABE080|USB 2.0 USB | Flash Drive USB Device |administrator.CLINTON, prnadmin.CUNTON | 3/8/2015 23:21 | 10/3/2015 10:51 


p-ngIST 13 nFFPanpa-epeernrsemneemeese . 
Associated User Accounts : 'First Connected |Last Written_ wi 


0000000F ASABEDE.0|USB 2.0 USB Flash Drive USB Device |administrator.CUNTON, prnadmin.CUNTON ; 3/8/2015 23:21! 3/10/2015 18:31 
OGOqQOOFASABEO8.0) USB 2.0 USB Flash Drive USB Device |administrator.CLINTON, prnadmin.CLINTON | 3/8/2015 23:21; 3/10/2015 18:31 


2GHIO26M__80 [Seagate DesktapUSBDevice © '-Not Found- 6/25/2013 13:33] 9/30/2015 21:03 
2GHIO26M_80 'SeagateDesktop USBDevice |-NotFound- _| 6/25/2013 13:31 Pierre 
2GHIO26M__&0 Seagate Desktop USB Device |-Not Found- , 6/25/2013 13:31: 3/10/2015 22:44) 
2GHIO2Z6M__&0_— :Seagate Desktop USB Device |-Not Found- { 


| 6/25/2013 13:31| 3/10/2015 22:44) 


HRC-1539 


ALL INECRMATION CONTAINED 
HEREIN IS JN CLASSIFIED 
UATE ll-28-2016 Bx g/GaleTeD Nelle 


er aan | | | - 
From: Chery! | bIC 
Sent: M ‘ 5 2:39 PM 


David Kendall 


Re: Email/Data Systems 


b6 
Deaf | b7c 


' Thank you for reviewing the existing tapes you collected with other equipment from the Clinton's residence 
when Platte River took over the systems in June 2013. | appreciate your review of those tapes, which you have 
stored in the data center since that time. 


As we have discussed in the last week and consistent with the preservation email David Kendal! shared with 
you, please do continue to preserve all relevant materials. 


Thank you so much. 
best. 


cdm 


b6 
i i oo bre 


Cheryl, 


Upon review of your email/data systems, we have not found any backups or any data that existed before we 
took over in June of 2013. However, we are backing up the data as it exists today, and continue to keep and 
maintain that retention policy. To our knowledge there are no backups or data on the systems that would hold 
any data previous to our involvement; that is not to say there could have been older backups that have since 
been overwritten or deleted, and could still be forensically found on the disks by means of advanced software. 
But this is not to our knowledge, and thus out of our control. Please let us know if you have any further 
questions or concerns. 


Thank you, 


b6 
b7C 


303.255.1941 
PLATTE RIVER NETWORKS 
IT SERVICES FOR BUSINESS 


Microsoft bias wevtvrg lotrantruad teers finhiticns 


Gente tos Meteo’ Sotutiqn ' 
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This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit http://www.mimecast.com 
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HRC-1540 


ALL [NEGRMATION CONTAINED 
HESEIN 15 UNLLASS U 


From: —— DATE 11-28-2016 BY Gf76JleTs0 NSIC 
; c 


Sent time: 08/17/2015 07:02:50 PM 
To: 

Ce: 

Subject: RE: Emails 
Attachments: Re: Email/Data Systems 


See attached! 


b6 
b7C 


PLATTE RIVER NETWORKS 
5700 WASHINGTON ST| DENVER, CO 80216 


303.255.1941 | PLATTERIVER.COM 


— Original Message—— 


b7C 


Sent: Monday, August 17, 2015 5:56 PM 


Subject: Emails 


Guys 


Do either of you have info on what we found on the server whe__Jwent Onsite last spring and what we shared with the Clinton staff? bé6é 


b7C 


HRC-1541 


ti 


Al HEDBMATION CONTAINED 
a to oTS UNCLASSIFIED 


a il 28-2016 Bl g/6clsTeo Nelco 


USB Devices — PRN Admin Server 


Sa ag gn mpeg errr ree 
‘Friendly Name lAssoclated User Accounts |First Connected [Last Written | 


Serlal Number 
O000000F ASABEO&O USB 2.0 USB Flash Drive USB Device ladministrator. CUNTON, pmadmin. CLINTON 3/8/2015 23:21 9/30/2015 21:03 


OOOD000F ASABEDE.0 USB 2.0 USB Flash Drive USB Device Jadministrator. CLINTON, prnadmin. CUINTON H 3/8/2015 23: 21} 10/ 3/2015 10:51 


O000000F ASABED&.0/ USB 2.0 USB Fla Flash Drive USB Device [einer .CUNTON, prnadmin.CLINTON | 3/8/2015 23:21: 3/ (10/2015 18:31 
(0000000F AS ABEO&.0| USB 2.0 USB Flash Drive USB Device |admintstrator.CUNTON, prnadmin.CLINTON | 3/8/2015 23:21, 3/10/2015 18:31| 
2GHIO26M_80 Seagate Desktop USBDevice _—_|-Not Found- -..____ [6/25/2013 13:31] 9/30/2015 21:03 
2GHI026M _ |__&0 ‘|seagate 2 Desktop usB Device i-Not Found- 6/25/2013 13. 3 13:31 "10/3/2015 10:51| 


| 

‘ ; 1 
2GHJO26M _ | &0 Seagate Desktop USB Device |-Not Found- io 6/25/2013 13:31] 3/10/2015 22: saa 
2GHJO26M__&0 -Seagate Desktop USB Device ,-Not Found- 6/25/2013 13: 31] 3/10/2015 22:44, 


HRC-1542 


8/20/2015 


Account Name : CESC 
, Work Type : Intuition Maintenance 


. Issue Type: 

, Sub-Issue Type : 

: Description: 

BY) 03/12/2015 Administrator, 
Autotask 

03/12/2015 Administrator, 


' Autotask 


/@® 0302015 
Summary Notes : 3/10 3 hours 


* Email move for CCM 
* Email flow troubleshooting 


tntution Maintenance : T20150309.0063 


' Account Name : CESC 
- Work Type : Intuition Maintenance 
_ Issue Type : 
Sub-Issue Type : 
Description: 


' 
03/10/2015 Administrator, 


'@ 03/09/2015 


Summary Notes : 3/9 
* Additional updates wit 


i Autotask 


30 min 


ALL INEURMATION CONTAINED 


BEBE IU 1S UNCLASSIFIED 
Tickets by Date 


Entered b n 03/10/2015 
Currently assigned t 


Proactive Maintenance 


Worked 3.00 hours (09:00 AM to 12:00 PM) 


DATE 1ll-2e-2016 AY J 760187TS0 NSILG 


b7C 


b6e 
b7Cc 


Status : Complete | 


Entered by} on 03/09/2015 
Currently assigned a | 


Proactive Maintenance 


Worked 0.50 hours (01:00 PM to 01:30 PM) 


https:/Avw 5.autotask.netreports/Service_Desk/report/rptTicketsByDate.asp 


b6 
b7C 


b6 
b7¢c 


13/19 


HRC-1543 


8/20/2015 


_BB reactivations : T20150316.0009 


Account Name : CESC 


' Work Type : Remote Support 


_ Issue Type : 


_ Sub-Issue Type : 


Description : 


“fF 03/6/2015 


‘EF 03/16/2015 


'@® 03/13/2015 


Summary Notes : 3/13 


Administrator, 
Autotask 


[ 


* BB re-activations wit 


CCM email : T20150312.0069 


' Account Name : CESC 


i Work Type : Remote Support 


' Issue Type: 


- Sub-Issue Type: 


- Description : 


Ej 0313/2015 


0312/2015 


@® 03/12/2015 


Administrator, 
Autotask 


ee 


Summary Notes : 3/12 1 hour 
* Migration issues with CCM email - troubleshoot 
* Additional security updates w/firewall 


Intuition Maintenance : T20150310.0038 


.5 hours 


Tickets by Date 


Entered by; on 03/16/2015 
Currently assigned to 


Service Request 


Worked 0.50 hours (10:00 AM to 10:30 AM) 


Entered b n 03/12/2015 
Currently assigned t 


Service Request 


Worked 1.00 hours (12:00 PM to 01:00 PM) 


https :/Avw 5§.autotask.nel/reports/Service_Desk/report/rptTicketsByDate.asp 


Status : Complete 


Status : Complete 


Status : Complete | 


b7C 


b7C 


b6 
b7C 


b6 
b7C 


12/19 


HRC-1544 


HEDRMATICN COUTAINED 
HEREIN [5 UNCLASSIPIEI 


From: = 3a) ATE 11-28-2016 BY J76d18TS0 weICcc b6 


Sent time: 13: b7C 
To: : 


Subject: CESC call 
— . 
b7C 


ty 
ae 
C 


HRC-1545 


From: 
Sent time: 
To: 
Subject: 


What about backups? 


| 


03/25/2015 02:23:21 PM 


Clintons 


ALL INSURMATION CONTAINED 
HEREIN [5 UNCLASSIFIED 
DATE 1ll-2e-2016 BY J 760187TS0 NSIC 


HRC-1546 


b6 
b7c 


ALL INSURMATION CONTAINED 
HEREIN [5 UNCLASSIFIED 
DATE 11-28-2016 Ay J 78018Ts0 


8/20/2015 Tickets by Date 


@ 0430/2015 Worked 4.00 hours (08:00 AM to 12:00 PM) 
Summary Notes : 4/30 4 hours 


* Server maintenance 4/30 


Helo 


b6 
b7¢ 


b6 
b7c 


Conf Call : T20150401.0019 Status : Complete 


Account Name : CESC Entered b on 04/01/2015 
Work Type : Remote Support Currently assigned t 
Issue Type : Service Request 


Sub-Issue Type : 
- Description : 


EE} 04/01/2015 Administrator, 
Autotask 


‘Q) 03/31/2015 Worked 0.50 hours (03:30 PM to 04:00 PM) 
Summary Notes : 3/31 30 min 


* Conf call with David/Cheryl 


| Conf Call : T20150325.0057 


Account Name : CESC Entered bf ion 03/25/2015 
' Work Type : Remote Support Currently assignedtd_ 


Issue Type : Service Request 
. Sub-Issue Type : 
_ Description : 


03/25/2015 Administrator, 
Autotask 


en 


https /Avw5.autotask.net/reports/Service_Desk/report/rptTickets By Date.asp 


b6 
b7c 


b7c 


Status : Complete 


b7C¢ 


10/19 


HRC-1547 


offsiteRetentionDeleted|D 
51908309 
51908311 
51908467 
51908568 
51908583 
51908588 
51908597 
51908598 
51908615 
51908632 
51908650 
51908651 
51908662 
51908681 
51908683 
51908693 
51908696 
51908709 
51908711 
51908729 
51908737 
51908742 
51908755 
51908762 
51908765 
51908772 
51908781 
51908782 
51908791 
51908792 
51908800 
51908813 
51908822 


devicelD agentName 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 césc-exch01 
20106 cesc-exch01 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch0O1 
20106 cesc-exch0O1 


pointTimestamp 
1422486354 
1422572728 
1422572728 
1426550580 
1427205815 
1426536192 
1427191331 
1426515266 
1427169769 
1426500171 
1427148269 
1426485711 
1427133859 
1426471336 
1427119391 
1426456942 
1427104921 
1426435474 
1427090571 
1426420975 
1427076145 
1426406552 
1427061765 
1426392157 
1427047343 
1426377741 
1427032926 
1426363391 
1427018496 
1426349009 
1427004103 
1426334549 
1426989738 


dateDeleted 
3/31/2015 11:27 
3/31/2015 11:27 
3/31/2015 11:32 
3/31/2015 11:35 
3/31/2015 11:35 
3/31/2015 11:36 
3/31/2015 11:36 
3/31/2015 11:36 
3/31/2015 11:36 
3/31/2015 11:37 
3/31/2015 11:37 
3/31/2015 11:37 
3/31/2015 11:38 
3/31/2015 11:38 
3/31/2015 11:38 
3/31/2015 11:39 
3/31/2015 11:39 
3/31/2015 11:39 
3/31/2015 11:39 
3/31/2015 11:40 
3/31/2015 11:40 
3/31/2015 11:40 
3/31/2015 11:41 
3/31/2015 11:41 
3/31/2015 11:41 
3/31/2015 11:41 
3/31/2015 11:42 
3/31/2015 11:42 
3/31/2015 11:42 
3/31/2015 11:42 
3/31/2015 11:42 
3/31/2015 11:43 
3/31/2015 11:43 


ALL 


HPORMATION (ONTAT 


HEU 


HESEIN 1S UNC UASS IE IED 


DATE ll-ee-20le By JF eUlLeTS0 NSILG 


size deletedBy 


2147483647 10.99.99.10 
2147483647 10.99.99.10 


2147483647 127.0.0.1 
1784575488 127.0.0.1 
2147483647 127.0.0.1 
2019729408 127.0.0.1 

391461888 127.0.0.1 
2147483647 127.0.0.1 
1558543360 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 

426132480 127.0.0.1 
2147483647 127.0.0.1 


867526144 127.0.0.1 — 


2147483647 127.0.0.1 
1357904384 127.0.0.1 
529785856 127.0.0.1 
2147483647 127.0.0.1 
1637800448 127.0.0.1 
1449253888 127.0.0.1 
1083220992 127.0.0.1 
1386481152 127.0.0.1 
2147483647 127.0.0.1 
881058304 127.0.0.1 
1259869184 127.0.0.1 
1382928384 127.0.0.1 
957980672 127.0.0.1 
1805410304 127.0.0.1 
186290688 127.0.0.1 
2147483647 127.0.0.1 
544729088 127.0.0.1 
1257823232 127.0.0.1 
921419264 127.0.0.1 


destroyType 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual! 
manual 
manual 
manual 
manual 
manual 


HRC-1548 


51908832 
51908837 
51908842 
51908856 
51908862 
51908875 
51908885 
51908891 
51908903 
51908908 
51908918 
51908923 
51908927 
51908936 
51908946 
51908953 
51908969 
51908978 
51908980 


51908992" 


51908994 
51909004 
51909003 
51909007 
51909009 
51909013 
51909015 
51909021 
51909022 
51909024 
51909027 
51909032 
51909033 
51909039 


20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchOl 
20106 cesc-exchOl1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchOl 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch01 


1426320132 
1426975341 
1426305759 
1426960960 
1426284221 
1426946536 
1426269811 
1426932101 
1426255394 
1426917709 
1426240923 
1426903358 
1426219409 
1426889010 
1426197898 
1426874634 
1426176753 
1426860183 
1426161751 
1426147311 
1426845699 
1426125827 
1426824197 
1426111468 
1426802701 
1426781210 
1426097081 
1426766529 
1426082603 
1426752111 
1426068116 
1426053715 
1426730586 
1426032684 


3/31/2015 11:43 
3/31/2015 11:43 
3/31/2015 11:44 
3/31/2015 11:44 
3/31/2015 11:44 
3/31/2015 11:45 
3/31/2015 11:45 
3/31/2015 11:45 
3/31/2015 11:45 
3/31/2015 11:46 
3/31/2015 11:46 
3/31/2015 11:46 
3/31/2015 11:46 
3/31/2015 11:46 
3/31/2015 11:47 
3/31/2015 11:47 
3/31/2015 11:47 
3/31/2015 11:48 
3/31/2015 11:48 
3/31/2015 11:48 
3/31/2015 11:48 
3/31/2015 11:48 
3/31/2015 11:48 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 
3/31/2015 11:49 


409286144 127.0.0.1 
1543983104 127.0.0.1 
914999296 127.0.0.1 
1794873856 127.0.0.1 
2147483647 127.0.0.1 
1059841536 127.0.0.1 
2147483647 127.0.0.1 
185225216 127.0.0.1 
2147483647 127.0.0.1 
467534336 127.0.0.1 
614016000 127.0.0.1 
1454828032 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1265425408 127.0.0.1 
411952640 127.0.0.1 
225860608 127.0.0.1 
2147483647 127.0.0.1 
1982041088 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
514964480 127.0.0.1 
2147483647 127.0.0.1 
258430464 127.0.0.1 
330622976 127.0.0.1 
635857920 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 


manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 


HRC-1549 


51909044 
51909046 
51909052 
51909069 
51909083 
51909081 
51909102 
51909105 
51909107 
51909110 
51909116 
51909119 
51909123 
51909125 
51909128 
51909131 
51909132 
51909136 
51909141 
51909143 
51909147 
51909154 
51909161 
51909167 
51909171 
51909184 
51909196 
51909212 
51909231 
51909242 
51909248 
51909266 
51909278 
51909292 


20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 


1426716164 
1426017879 
1426694715 
1426003520 
1425988939 
1426680192 
1425974533 
1426665756 
1425960162 
1426644272 
1425938664 
1426629792 
1425924194 
1426615452 
1426601049 
1425909832 
1425895311 
1426586571 
1426565062 
1425880940 
1425859474 
1425845017 
1425830617 
1425816133 
1425801745 
1425776723 
1425762252 
1425747860 
1425733390 
1425718922 
1425704582 
1425683150 
1425668666 
1425654243 


3/31/2015 11:50 
3/31/2015 11:50 
3/31/2015 11:50 
3/31/2015 11:51 
3/31/2015 11:51 
3/31/2015 11:51 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:52 
3/31/2015 11:53 
3/31/2015 11:53 
3/31/2015 11:53 
3/31/2015 11:53 
3/31/2015 11:53 
3/31/2015 11:53 
3/31/2015 11:53 
3/31/2015 11:54 
3/31/2015 11:54 
3/31/2015 11:54 
3/31/2015 11:55 
3/31/2015 11:55 
3/31/2015 11:56 
3/31/2015 11:56 
3/31/2015 11:57 
3/31/2015 11:57 


2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1055816704 127.0.0.1 
1973435392 127.0.0.1 

876412928 127.0.0.1 
1374854656 127.0.0.1 
1553204224 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 

217388032 127.0.0.1 
1770064384 127.0.0.1 
2147483647 127.0.0.1 
1306884608 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1075906048 127.0.0.1 
1045999616 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1758722560 127.0.0.1 
526188544 127.0.0.1 
1651510272 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 


manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 


HRC-1550 


51909310 
51909321 
51909332 
51909342 
51909358 
51909374 
51909388 
51909395 
51909399 
51909404 
51909411 
51909415 
51909423 
51909426 
51909433 
51909437 
51909447 
51909457 
51909461 
51909467 
51909476 
51909485 
51909492 
51909498 
51909510 
51909514 
51909520 
51909528 
51909539 
51909547 
51909555 
51909560 
51909570 
51909574 


20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exchOl 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1l 


1425639736 
1425618246 
1425596896 
1425582241 
1425567860 
1425553322 
1425531794 
1425510424 
1425495936 
1425481441 
1425466915 
1425445432 
1425423921 
1425409458 
1425395011 
1425380507 
1425366141 
1425351767 
1425330284 
1425315940 
1425301359 
1425286923 
1425272567 
1425258177 
1425243808 
1425229392 
1425214909 
1425200517 
1425186174 
1425171778 
1425157378 
1425143032 
1425128524 
1425114111 


3/31/2015 11:58 
3/31/2015 11:58 
3/31/2015 11:58 
3/31/2015 11:59 
3/31/2015 11:59 
3/31/2015 12:00 
3/31/2015 12:00 
3/31/2015 12:00 
3/31/2015 12:00 
3/31/2015 12:01 
3/31/2015 12:01 
3/31/2015 12:01 
3/31/2015 12:01 
3/31/2015 12:01 
3/31/2015 12:01 
3/31/2015 12:01 
3/31/2015 12:02 
3/31/2015 12:02 
3/31/2015 12:02 
3/31/2015 12:02 
3/31/2015 12:02 
3/31/2015 12:03 
3/31/2015 12:03 
3/31/2015 12:03 
3/31/2015 12:03 
3/31/2015 12:03 
3/31/2015 12:04 
3/31/2015 12:04 
3/31/2015 12:04 
3/31/2015 12:04 
3/31/2015 12:04 
3/31/2015 12:05 
3/31/2015 12:05 
3/31/2015 12:05 


652189696 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 

409280512 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 

453376512 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 

343230464 127.0.0.1 

993950208 127.0.0.1 
1680826880 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1448999936 127.0.0.1 

289822720 127.0.0.1 
1210885632 127.0.0.1 
1747767808 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 

219101696 127.0.0.1 

101869056 127.0.0.1 
1022279168 127.0.0.1 
1649956864 127.0.0.1 
1883486208 127.0.0.1 
2147483647 127.0.0.1 

582242816 127.0.0.1 

380931584 127.0.0.1 


manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual! 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual! 
manual 
manual 
manual 


HRC-1551 


51909589 
51909601 
51909604 
51909623 
51909630 
51909641 
51909649 
51909653 
51909661 
51909667 
51909672 
51909679 
51909684 
51909687 
51909698 
51909701 
51909707 
51909711 
51909717 
51909724 
51909727 
51909737 
51909745 
51909751 
51909754 
51909761 
51909765 
51909775 
51909784 
51910359 
51910367 
51910376 
51910378 
. 51910382 


20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch01 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exch0Ol1 
20106 cesc-exch0O1 


1425078346 
1424991939 
1424905556 
1424819102 
1424739896 
1424653376 
1424566997 
1424474299 
1424387113 
1424300729 
1424221492 
1424127906 
1424048560 
1423962143 
1423868704 
1423782296 
1423703188 
1423609541 
1423523097 
1423450971 
1423364533 
1423263879 
1423184703 
1423091107 
1423004744 
1422918278 
1422846147 
1422759752 
1422666618 
1426845699 
1426802701 
1426615452 
1426586571 
1426536192 


3/31/2015 12:06 
3/31/2015 12:07 
3/31/2015 12:07 
3/31/2015 12:09 
3/31/2015 12:09 
3/31/2015 12:09 
3/31/2015 12:10 
3/31/2015 12:10 
3/31/2015 12:10 
3/31/2015 12:10 
3/31/2015 12:10 
3/31/2015 12:10 
3/31/2015 12:11 
3/31/2015 12:11 
3/31/2015 12:11 
3/31/2015 12:11 
3/31/2015 12:11 
3/31/2015 12:11 
3/31/2015 12:12 
3/31/2015 12:12 
3/31/2015 12:12 
3/31/2015 12:12 
3/31/2015 12:12 
3/31/2015 12:13 
3/31/2015 12:13 
3/31/2015 12:13 
3/31/2015 12:13 
3/31/2015 12:13 
3/31/2015 12:14 
3/31/2015 12:38 
3/31/2015 12:38 
3/31/2015 12:38 
3/31/2015 12:38 
3/31/2015 12:39 


2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1284926976 127.0.0.1 
1753640448 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1016056832 127.0.0.1 
752560128 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1843744768 127.0.0.1 
895870464 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1241155072 127.0.0.1 
1415788544 127.0.0.1 
2147483647 127.0.0.1 
225860608 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1770064384 127.0.0.1 
2019729408 127.0.0.1 


manual! 
manua! 
manual! 
manual 
manual 
manual! 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 


- manual 


manual 
manual 
manual 
manual 
manua! 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manua! 
manual 
manual 
manual 
manual 
manual 


HRC-1552 


51910388 
51910401 
51910403 
51910407 
51910412 
51910416 
51910421 
51910428 
51910433 
51910436 
51910441 
51910446 
51910449 


20106 cesc-exch0O1i 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch01 
20106 cesc-exchO1 
20106 cesc-exchO1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exch0O1 
20106 cesc-exchO1 


1426500171 
1426377741 
1426363391 
1426176753 
1426161751 
1426125827 
1426068116 
1426032684 
1426003520 
1425988939 
1425974533 
1425909832 
1425880940 


3/31/2015 12:39 
3/31/2015 12:39 
3/31/2015 12:39 
3/31/2015 12:39 
3/31/2015 12:39 
3/31/2015 12:40 
3/31/2015 12:40 
3/31/2015 12:40 
3/31/2015 12:40 
3/31/2015 12:40 
3/31/2015 12:40 
3/31/2015 12:41 
3/31/2015 12:41 


2147483647 127.0.0.1 
1382928384 127.0.0.1 
1805410304 127.0.0.1 
2147483647 127.0.0.1 
1265425408 127.0.0.1 
2147483647 127.0.0.1 
330622976 127.0.0.1 
2147483647 127.0.0.1 
2147483647 127.0.0.1 
1055816704 127.0.0.1 
876412928 127.0.0.1 


2147483647 127.0.0.1 © 


1306884608 127.0.0.1 


manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 
manual 


HRC-1553 


ALL DHEORSATICN JUON TAINED 
HEREIN [5 UPUCLASSIEIEU 


BleachBit — PRN Admin Server UATE 11-26-2016 BY J7eclsTs0 weice 


CCS Program Files (x86) 
EHEC Bleachsit 
HEC) Cisco Systems 
E> E) Common Files 
E> E Fortinet 
EC} Google 
CC) InstallShield Installation Information 
G-} Cy Internet Explorer 
EC JAM Software 
ECC Java 
EHEC Kroll Ontrack 


Bleachbit.ini: 


e Cleaning: Most recently used items, recent documents, and recycle bin 
e Shredding: Overwrite free space on F: drive 


Name Type Data 
ai Lang!D REG_BINARY 0904 


(ab) CAProgram Files (x86)\Google\Chrome\Application\chrome.exe REG SZ Google Chrome 
CAWindows\LTSvc\LTTray.exe 


Advanced IP Scanner 
[ab C:\Users\prnadmin\Downloads\putty.exe _ SSH, Telnet and Rlogin client 


Time 


(Eastern) 
3/31/2015 | 12:01:48 PM | Program Files (x86)\Bleachbit created 
12:01:53 PM Users\prnadmin.CLINTON\AppData\Roaming\BleachBit 


created/accessed/modified 


3/31/2015 
3/31/2015 
3/31/2015 


3/31/2015 | 12:16:08 Pm 


12:01:53 PM Users\prnadmin.CLINTON\AppData\Roaming\BleachBit\bleachbit ini 


created/accessed 


12:14:04 PM 


Users\prnadmin.CLINTON\AppData\Roaming\BleachBit\bleachbit ini 
modified 


Program Files (x86)\Bleachbit accessed/modified 


HRC-1554 


BleachBit — Exchange Server 


Time 
(Eastern) 
11/29/2014 | 11:02:50 AM 


3/31/2015 | 11:42:01 AM 


3/31/2015 
3/31/2015 | 11:44:28 AM | Path: ...C:\Program Files (x86)\BleachBit\uninstall.exe 


3/31/2015 | 11:44:31 AM 


3/31/2015 


3/31/2015 


3/31/2015 


Registry Key: \ControlSet001\Control\Session Ma nager\AppCompatCache 


Path: ... C:\Program Files (x86)\BleachBit\BleachBit.exe 


URL: http://bleachbit.sourceforge.net/download 


Registry Key: \ControlSet001\Control\Session Manager\AppCompatCache 


11:43:41 AM | Path: --€:\Users\prnadmin.CLINTON\Downloads\BleachBit-1.7-setup.exe 


Registry Key: \ControlSet001\Control\Session Manager\AppCompatCache 


Users/prnadmin.CLINTON/AppData/Roaming/BleachBit/bleachbit ini 


Registry Key: 
\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFFS 
CD-ACE2-4F4F-9178-9926F41749EA}\Count] 

12:15:14 PM C:\Users\prnadmin.CLINTON\Downloads\BleachBit-1.7-setup.exe 


Registry Key: \ControlSet001\Control\Session Manager\AppCompatCache 


12:15:24 PM | Path: ...C:\Program Files (x86)\BleachBit\uninstall.exe 


12:15:27 PM Users/prnadmin.CLINTON/AppData/Roaming/BleachBit/bleachbit ini 


HRC-1555 


ALL TNEORSATICN OONTAL 


HEREIN [5 UNCLASS 


zi 


HED 


DATE 11-28-2016 BY 278018780 NSICG 


June of 2013 


Migrated 

Blackberry server — still exists in its old state. May have transaction log information 
Old server — no data — 

2014 HRCoffice.com registered in June 

PST files rested 

2” or 3° week transition to HRCOffice.com 


PST Files were shredded 


HRC-1556 


PRN Admin Server 


Event ID 


[nd 


11,724 
1,728 
11,707) 
11,707: 
11,728 
11,728 
11,728 
11,707, 
11,728 
11,728 
11,707 
11,707 
11,707 
11,728 
11,707 
11,707 
11,707 
11,707 
11,707 
114,728 
11,707 
11,707" 
11,724 
11,707. 
11,728 
11,707 
11,707: 
11,707 
11,707° 
11,707" 
11,707 
11,707 


Time Generated. SID 
10/1/2015 11:28:50 PM_S-1-5-21-2195671152-1263538465-33 10924795- 1643 
“10/1/2015 12:28:41 PM_ S-1-5-21-2146671152-1263538465-3310924795-1643 
9/25/2015 10:42:14 AM S-1-5-21-2146671152-1263538465-3310924795-1643 
9/25/2015 10: 38:42 aM 5-1-5-21-2146671152-1263538465-33 10924795- 1643 
9/25/2015 10:38: 09.AM S-1-5-21-2145671152-1263538465-3310924795-1643 
9/25/2015 10:38:09 AM S-1-5-21-2146671152-1263538465-33 10924795-1643 
9/25/2015 10:38:09 aM S-1-5-21-214667 1152-1263538465-33 10924795- 1643 
9/15/2015 4:48:00 PM S-1-5-18 
9/10/2015 2:01: 40 am’ S-1-5-18 
0/26/2015 10: 42:00 Pn $-1-5-18 
8/17/2015 12:36:00 aM S-1-5-18 
6/9/2015 10:56:22 AM S-1-5-18 
6/9/2015 1:03: 19 AM’ S-1-5-18 
5/25/2015 6:32:14PM S-1-5-18 
8/15/2015 1:30:00 PM S-1-5-18 
9/11/2015 10:24:55 aM S-1-5-18 
9/6/2015 6:25:04 am S-1-5-18 
4/5/2015 1:24:36 AM S-1-5-18 
4/2/2015 10:24: 226 PM ' S-1-5-18 
3/25/2015 9: 24: 57 aM S-1-5-18 
2/26/2015 1:15:42 PM! S-1-5-21-2146671152-1263538465-3310924795-1643 
2/5/2015 9:29:00 AM S-1-5-18 
1/26/2015 2:41:17 PM $-1-5-21-2146671152-1263538-465-3310924795-500 
1/23/20 15 11:51:04 AM S-2-5-18 
1/8/2015 9: 19:51PM S-1-S-18 
1/5/2015 3:31:33 PM, 5-1-5-21-2146671152-1263538455-33 10924795-500 
4/5/2015 331: 13 PM $-1-S-21-2 146671 152-126353846S-33 10924795-500 
4ys/2015 3:30:38 PM S-1-S-21-2146671152-126353846S-3310924795-500 
1ys/2015 3:30:37PM S-1-S-21-2146671152-1263538465-3310924795-S00 
15/2015 3:30:33 PM $-1-5-21-2146671152-1263538465-33 10924795-500 
14/5/2015 3:29:47 PM. S-1-S-21-2146671152- 1263538465-3310924795-500 
15/2015 3:29:46 PM S-1-5-21-214667 1152-1263538465-3310924795-500 
1445/2015 3:29:26 PM S-1-5-21-214667 1 152- 1263538465-33 10924795-S00 


ALL [NSUR DATION CONTAINED 
RESET IS JUG CLASSIFIED 


- Installed/Uninstalled Application Events: 27 11-28-2016 By a76s18780 wsIcc 


Message 


‘ Product: ScreenConnect Client (sa0488eadb285db 1) — Removal completed successfully, 


Product: ScreenConnect Glent (56cfa98e32ea8 13a) — Removal completed successfully. 


» Product: Ontrack PowerControls 7.2 ~ Configuration completed successfully. 


Product: Ontrack PowerContrals 7.2 ~ Installation operation completed successfully, 

Product: Ontrack PowerControls 7,2 -- Installation operation ‘completed successfully, 

Product: Microsoft Visual C++ 2008 Redistributable - x86 9.0, 30729. 17 ~ Configuration completed successfully 
Product: Microsoft Visual C++ 2005 Redistributable ~ Configuration completed successfully. 

Product: Google Update Helper -- Configuration completed successfully. 


"Product: ScreenConnect Client (aa0488eadb2aSdb 1) ~ Installation completed successfully. 


Product: Google Update Helper — Configuration completed successfully, 
Product: Google Update Helper — Configuration completed successfully. 
Product: SceenConnect Cllent (SécfaS6e32e88 13a) ~ Installation completed successfully. 


Product: ScreenConnect Client (56cfa98e32ea8 13a) ~ Installation completed successfully, 


Product: Google Apps Sync" for Microsoft Outlook® 3.7.4 10. 1100 -- Installation completed successfully, 
Product: Google Update Helper ~ Configuration completed successfully. 

Product: Google Apps Sync’” for Microsoft Quttook® 3. 7.400, 1050 -- Installation completed successfully. 
Product: Google Apps Migration For Microsoft Outlook® 3. 4.27.52 -- Installation completed successfully. 
Product: Google Apps Sync’™ for Microsoft Cutlook@ 3.7. 395. 1040 ~ Installation completed successfully, 
Product: Google Apps Migration For Micrasoft Outlook® 3.3.25. 50 -- Installation completed successfully. 
Product: Google Apps Migration For Microsoft Outlook® 3.2.23, 48 -- Installation completed successfully. 
Product: Trend Micro Client/Server Seaurity Agent — Configuration completed successfully. 


Product: Google Update Helper — Installation completed successfuly, 
Product: FortiClient SSLVPN v4.0.2300 — Installation completed successfully, 


Product: Managed Workplace Onsite Manager — Removal completed successfully. 
Product: Google Apps Migration For MicosoR Outlook® 3. 1.21.46 ~ Installation completed successfully. 
Product: Ontrack PowerControls 7,2 ~ Configuration completed successfully. 


, Product: Ontrack PowerControls 7,2 -- Installation operation completed success fully. 


Product: Ontrack PowerControls 7.2 -- Installation operation completed successfully. 

Product: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729. 17 -- Installation completed successfully. 
Product: Microsoft Visual C++ 2005 Redistributable -- Installation completed successfully, 

Product: Micosoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 -- Installation completed successfully. 
Product: Micosoft Visual C++ 2012 x86 Minimum Runtime - 1 1.0.60610 -- Installation completed successfully. 
Product: Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729. 17 -- Installation completed successfuly. 


HRC-155/ 


ALL INSORRATION CONTAINED 


: HEREIN IS UNCLASSIFIED b6 
cae =e DATE 11-28-2016 BY J76J187T20 NSICG 4, 
Sent time: 04/24/2015 10:24:41 
To: 
Ce: 
Subject: 
. . . . b6 
[Jere is an overview of next week. | am going to go ahead and move CESC to Thursday. Do you need anything else moved around or added? b7c 
MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY 
27 28 29 30 1 


{ 295: Zoom Mer Greshain Partners _ Minos & Az A 
! Calm Intuition Maintenance Remote - Brown 
| Q- 650 5. Chetry 
i Cannon ‘ i St, Suite 1100 
0h denver Cl 
City-Remote Derive ‘i co 
Intuition % oO 
Maintenance oo: PES ee wo 
128 Main Che, 
z ane 750 third 
Street Cafion ss r 
aneeaaes : Avenue New ‘ 3 
City, CO Now —————a oe te ee 
81215 10017 Minor Brown | ContactEase | Plal Gresham : 
Database Instailati code 163260 | 
Callin number| ——] | c) 
1.031! ! - ar 


t 


Unavailable (Every Friday) - 
Transporting 


a Private Appointment > @ 


HRC-1558 


ALL DNEORSATICH CONTAINED 
BEREIN [5 UNCLASSIFIED 
DATE 11-28-2016 BY 278018780 NSIlCe 


8/20/2015 Tickets by Date 


Summary Notes : 8/18 2 hours be 
* Contingency planning and security updates b7c 


@ 08/18/2015 =i Worked 1.50 hours (09:30 AM to 11:00 AM) bé 
Summary Notes : 8.18.1. PRN (9:30a — 11:00a) 1.Shrs On Call is 
* Logged in and reviewed the monitoring. 


* Made sever. ges to the monitors for the firewalls and our reporting. 
* Worked with nd the team to get the Datto backups working again. 
Ej 08/13/2015 Administrator, 
Autotask 


-® 081132015 [ Worked 1.00 hours (11:00 AM to 12:00 PM) Be 


b7Cc 
Summary Notes : ens, | hour 
*PR arm conf call 


Sa i = é a “ & dew = ‘ah 3 b7C 


© 08/12/2015 Worked 20.00 hours (05:00 AM to 01:00 AM) b6 
Summary Notes : 8.12.1 RN (5.00a — 1:00a) 20hrs On Call Bre 


“ Left for the airport and boarded a flight to NYC. 

* Arrived at the datacenter and powered on the old server. 

* Reviewed for any misc PRN software or garbage files we could have left behind (ie. Our old AV software, old 
monitoring software, etc). 

* Server is clean, shutting it back down. 

* Removed server from the rack and placed ona cart. 

* FBI agents met me outside, and ! signed the two pieces of dansewain to turnover the server to them for 

| investigation. 


* Returned to the datacenter and worked wit Jo increase security measures by proxying the SSL for Exchange | b6 
to the firewall. bic 
* This will ai i e IIS server on the Exchange system. b7E 
* Ensured 7 a is cabled properly and working. 
* We have already updated the firmware on the two firewalls, no need to do any other work. 


* Returned to the airport and returned home. 


b6 
| © 08/10/2015 Worked 1.00 hours (03:00 PM to 04:00 PM) — 
Summary Notes : 8.10.1 PRN (3:00p — 4:00p) 1hr On Call 


* Worked with our attorneys on communication. 
* Worked with PRN team on planning for the trip out to NYC. 
* Went over logistics and the process of the server handoff. 


© 08/06/2015 Worked 1.00 hours (04:00 PM to 05:00 PM) b6 
‘ Summary Notes : 8/6 1 hour b7c 


* Answered questionnaire 
* Backup research 
* Internal discussion 


b6 


https /Avw5.autotask.net/reports/Service_Desk/reportrptTicketsByDate.asp 3/19 


HRC-1559 


ALL INFORMATION CUNTAINED 
BEBEIN [5 UN LASS FIED 
DA il -2s8-2016 BY 2/GclsTe0 NSicG b6é 


From: 
3 b7C 
Sent time: 08/18/2015 11:21:05 AM 
To: : 
Subject: RE: email 


No, think it was all phone comms 


FromL___ | b6 
Sent: Tuesday, August 18, 2015 12:16 Bic 
To 

Subject: Re: email 


You ever find an email about them cutting the backups? 


Sent from my iPhone 


b6 


That is a LOT of emails, on my part anyway, going back 2 years. | will have all of my sent items, but not incoming 
items. | only keep deleted items for 6 months : 


FromL___ = 
b7c 


Sent: Tuesday, August 18, 2015 12:08 
To 
Ce: 
Subject: emai 


Please collect all email communications regarding CESC whether it’s internal or external communications. We 
may have to produce that information and | think it’s best to have that ready. 


Thanks, 
b6 
b7C 


5700 WASHINGTON ST | DENVER, CO 80216 
303.255.1941 | PLATTERIVER.COM 
<image001.jpg> 

<image002.jpg> 


HRC-1560 


ALL INPORSIATION CONTAINED 
HEREIN IS UNCLASSIFIED 


From: | DATE 1li-28-2016 BY Gye 18720 NSIC: b6é 
Sent time: 59:16 PM b7Cc 
To: 


Subject: RE: Datto remote access 


We haven't gotten approval from CESC and when we spoke with the Data Center they said we need approval from CESC to ship 
it to the data center, because the agreement between the data center is between CESC & the Data Center. 


b6 
b7c 


PLATTE RIVER NETWORKS 


5700 WASHINGTON ST | DENVER, CO 80216 


303.255.1941 | PLATTERIVER.COM 


From{___ bé 
Sent: Friday, August 21, 201 : b7c 
To 

Subject: RE: Datto remote access 


When is that going onsite? We can use the datacenter smarthands to install it in the rack sof __}oesn’t have to go out again b6 
b7c 
From b6 


Sent: Friday, August 21, 2015 10:41 b7c 
+ fe 


Subject: RE: Datto remote access 


What we have is a new Datto to ship out there to replace the current Datto and turn on encryption. | believe the encryption 
key would be created by CESC and we would have the key. So we have to understand how encryption prevents access. 


b7c 


PLATTE RIVER NETWORKS 


5700 WASHINGTON ST | DENVER, CO 80216 


303.255.1941 | PLATTERIVER.COM 


‘ 7c 
Sent: Friday, August 21, 2015 7:29 AM a 
2 ae 
HRC-1561 


Subject: FW: Datto remote access 


?? 

From: b6 
Sent: Eri 2015 09:10 b7c 
To; 


Subject: Re: Datto remote access 


Good moming —_| b6 


b7Cc 


Thanks for reaching out. 


I believe our legal teams have discussed this issue in detail and have come up with a solution to this problem _ | would check with 
your team and see if they have those details. Let me know if you have any other questions I might be able to assist with. Thanks. 


Best regards, 


be 
b7c 


Datlo, Inc. 


www.dalto.com 


datto 


Total Data Protection: 


Protect Your Data Everywhere 
You Do Business 


LEARN MORE 


Join the conversalion! | L] LC] L] L] J C 


On Thu, Aug 20,2015 at8:27PM[ wrote: b6 
[ ~ 


i 
| 
' We are trying to tighten down every possible security angle on this customer. It occurs to us that anyone at PRN with access to 


' the Datto Partner Portal (ie, everyone here) could potentially access this device via the remote web feature. Can we set up 
' either two-factor authentication, or move this device to a separate partner account, or some other method (disable remote web 


HRC-1562 


| altogether?) to allow only who we permit on our end to access this device via the internet? 


4 
| The serial # in question is 002590AFDEBE 


‘ 
t 


| Let me know, thanks! 


| 


b7c 


‘ 
' 
' 


‘ This email has been scanned for email related threats and delivered safely by Mimecast. 
! For more information please visit http://www.mimecast.com 
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ALL INEURMATION CONTAINED 
HEREIN IS UNCLASSIFIED 


From: DATE 11-28-2016 BY J76d1eTso nstcc bé 
Sent time: 08/20/2015 11:37:40 PM Bie 
To: 

Subject: RE: CESC Datto 


Datto shut it off. 


b6 
b7c 
PLATTE RIVER NETWORKS 
5700 WASHINGTON ST | DENVER, CO 80216 
303.255.1941 | PLATTERIVER.COM 
a - 
Sent: Thursday, August 20, 2015 9:36 PM c 
SE 
Subject: Re: CESC Datto 
did you guys turn off the off-site backups? We had discussed the possible ramifications of shutting them off, but we hadn't heard from be 
Datto yet. All | know is that they are not currently running, and you mentioned them shutting down the node it was backing up to. b7Cc 


I've emailed _ fo see if we can further lock down access to the Datto. 


noeeee Original message------ 

Fron bé 
Date: Thu, Aug 2 ; b7Cc 
T ee 

Subject:Re: CESC Datto 


So does this mean we don’t have offsite backups currently? That could be a problem if someone hacks this thing and jacks it up. We will have 
to be able to produce a copy of it somehow, or we're in some deep shit. Also, what ever came from the guys at Datto about the old 
backups? Do they have anyway of getting those back after we were told to cut it to 30days? 


b6 
b7C¢ 


303.285.1941 


JS PLATTE RIVER 


. metworks 


ae btracwurnnse Sahenone COLORADO es 
GOLO CERTIFIED | “se etna Kpectatas Comemrusntty 
Panne Ofte Copteymem 


PAKTNERS 
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en re eee 


From[___ b6 
b7c 


Date: Thurs 2 
To 
Subject: RE: CESC Datto 


It’s no longer replicating data offsite, but we can still use the partner portal to remotely access the device without additional 
authentication | believe 


b6 
| —el b7C 
Sent: Thursday, August 20, 2015 18:25 
Subject: RE: C Datto 


It is my understanding the node that the data was being replicated to is offline and no longer accessible. If you want to confirm 
that, please do. 


b6 
b7¢ 


PLATTE RIVER NETWORKS 


5700 WASHINGTON ST | DENVER, CO 80216 


303.255.1941 | PLATTERIVER.COM 


be 
From ae 


Sent: Thursday, August 20, 20 : 
5 ES] 
Subject: atto 


Should we talk with Datto about moving their backup device to a separate partner account or other security features? Right 
now, anyone with portal access could potentially access the web UI of the datto and boot VMs etc 
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ALL INPURRATICN CONTAINED 
HEREIN [5 UNCLASSIFIEO 
ATE 11-28-2016 BY 276018780 Hale 


PRN Exchange Server — DATTO 


Visits to Control Panel for CESC-DATTO 


Multiple visits to http://192.168.42.20/login.php and 


http://192.168.42.20/UI/login.php 


9/23/2016 9:08 PM http://192.168.42.20/UI/recoveryPoints.php?agent=cesc- 
exch01 


| 9/25/2016 | 1:40 PM http://192.168.42.20/UI/UI_settings.php ?agent=cesc-exchOl 


9/25/2016 2:35 PM http://192.168.42.20/UI/UIRestore-file.php ?agent=cesc- 
exch01&point=1443182506L 

9/25/2016 | 5:38PM http: //192.168.42.20/UI/UI_kroll php 
9/26/2016 [5:20PM http://192.168.42.20/U/agentsphp 


PRN Admin Server — DATTO 


Various 


Visits to Control Panel for CESC-DATTO 


stea iwe  e 
10/1/2016 6:17 PM http://192.168.42.20/login.php 
10/1/2016 6:17 PM https://auth.datto.com/login 
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Aull INFORMATION COUTAINED 
HEREIN [5 UNCLASS IP IEI 
Be 11-26-2016 Br g/ecleiTs0 HeilcG 


PRN Admin Server - Recent Documents, Typed Paths 


User: administrator.CLINTON 


Software\Microsoft\Windows\CurrentVersion\Explorer \RecentDocs\.pst 
LastWrite Time Fri Sep 25 19:56:18 2015 (UTC) 
MRUListEx = 0 

@ = Export.pst 


Software \Microsoft\Windows \CurrentVersion\Explorer\TypedPaths 
LastWrite Time Fri Sep 25 18:08:52 2015 (UTC) 


urll C: \Users\prnadmin.CLINTON\Documents\ScreenConnect\Files 
url2 \\192 .168.42.250\cesc 

ur13 \\192.168.42.250\ 

url4 \\10.0.99.10 

url5 ftp: //home.platteriver .com/ 
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ALL TNEURUATICN JOU TAINED 
HEREIN 16 URCLASSIEIEU 
DATE ll-26-20lo BY J /ecleTs0 balce 


September - October 2015 


[Source ; Event Description 


Outlook Office Alert event log message "Are you sure that you want to permanently delete the selected item(s)?" on PRN 
9/25/2015 10:24 AM|PRN Admin Server |Admin Server. 


9/25/2015 10:28 AM|PRN Admin Server 
9/25/2015 10:38 AM|PRN Admin Server 


9/25/2015 2:10 PM/JPRN Admin Server 
9/25/2015 2:10 PMIPRN Admin Server 


9/25/2015 2:35 PM|PRN Exchange Server | Chrome History: http://192.168.42.20/UI/UlRestore-file.php?agent=cesc-exch01&point=1443182506L 
9/25/2015 3:56 PM|PRN Admin Server IE History indicates "C:/Users/prnadmin.CLINTON/Desktop/Export.pst" visited on PRN Admin Server. 


Outlook messagein the Office Alerts event log on the PRN Admin Server indicates "Are you sure you want to remove this 
 syos/acus System event log on the PRN Admin Server indicates "Disk Defragmenter service entered the running state" (outside of 


a 
3 
® 


Outlook Office Alert event log message "Are you sure you want to remove this mailbox?" on PRN Admin Server. 


Shortcut files “OnTrack PowerControls for Exchange.Ink" and "Ontrack PowerControls ExractWizard.Ink" created in the 
Windows Start menu on the PRN Admin Server. 


Shortcut file "C:\Users\prnadmin.CLINTON\AppData\Roaming\Microsoft\Windows\Recent\Export.Ink" pointing to 
"C:\Users\prnadmin.CLINTON\Desktop\Export. pst" created on PRN Admin Server. 
Application event log on PRN Admin Server indicates Outlook message "The store 
C:\Users\prnadmin.CLINTON\Desktop\Export.pst" is being re-pushed to the indexer for the following reason: Newly created 
store." 


normal scheduled time; otherwise, 6-7 AM) 


9/29/201 4:32:46 PM|PRN Admin Server _ |Chrome cache indicates "http://192.168.42.20/" (CESC-DATTO) visited 


P 
10/1/201 6:17 PM|PRN Admin Server __ [Visit to http://192.168.42.20/login.php (CESC-DATTO) on PRN Admin Server ; 
10/2/2015] 12:36 PM|PRN Admin Server bs 


10/2/201 1:57:50 PM{PRN Admin Server __|\SRecycle.Bin\<prnadmin.CLINTON>\ folder accessed/modified timestamp b7c 


Wiytu 


: 


w 
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ALL TNEURRATIOCN CON TALNED a 
HEREIN 1S UNL LASS IP LEL 
mele ll-2e-20le By | )egleleo NS ILG 


C7 six 


b6 


Reached out by email Tied to do tt remote la ; b7C 

Pfraid of lost the email. So wanted +o impout it. 

Bie ot Mac Mail _couldnd get it te Connect +o. rer 

~Z 10 fay 

Asked Monica to send laptop 

Some 0 gy am Moat expevits | converts to pst 

EX poled. From Maw Mall as Separate PSts Gyrack 
Gilde - Named by date ; | 

Separate Ps on the seyVtr- Called LARC Dvehkive ” 
Ly Exe hanse reagaive S you to have an emai | 


Hed 40 ib | 
» Put wh i. ue mark en | — 
ly added aed MGonrS Be eer tun pepe 
uM prekab ty 
Demo’ fe[ | usid Ser ster Ganeck 42 Show hea a 


how 4 add He weilhy inh Soca! Datleok client 


Once im por tédl Hee mel , just dele fed He waif brow Maclal 
by Did hat Wipe later 


Here Archive not on Strver — Surprised 
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Z/e3/t4 — submit fo State. Department 
Ait a" 7 diftarent rbevations of emarl Shp 1 own yoy 
Pp mon ke expow + ded happen corre ctl, 
~ Mens used Oithok ov Farce bell 


Hee achive - Complete ” pripably when fey requested el 


2me ls /a ter 


Buvecd DVDs vr Arranged a pre Rap _ Destia ged DVDs 
Wanttsd 4 4ransmit Uae Seeure Preans 


Text batek processtey heals —s Coucerned alout- egaal 
adlvess heirs d-hove nt Plan what 
che used bebre 

~ W/ Brien + Cheg! 

-— 4 the email adleess at some past 
So that Chaused hee addveSS on 
al the eld temas! She Sent 


ee Ae, : 
Zigler - wenn y Citas ®CCoundt vecd. for Pes tii. bic 


~ we haw o management Ld} On Sherr Server 


# lea] - F/30/14 - bovke Ww] cth Healtker atgcess to 
the av chive mat box (He S eV cept ) 
b&b Mt vesumabl, wo 
ut dhat pst en their wovkcstetion b6 
Both P54 P42 Ssuavd protection / 2p wanes encrypt: Dy pie 
Wedd Tran ster Nie Soren Connect (Did hor bet 9a deen leh 
yack” _ HRC/L570 
Placed On lompaters [ bhaced ftom he w to tmpret into Outlook 


| | zl 


9 Jeqliy¥ - new mail orchve Sottas - Call 
presumes this (5 He 2% complete. edpwt 
~ Slual 54s at least 
~ expe vod (File > cpeet of her moi lboxp 
At Some pant wel ded 6 tve Someone access to he HR CAN chia 
[: + Mes was oo Ca ports 


4 LE exprvt HRC Arekive oe HED [We marlbeoy a both 7 
lo if File > expat , would haus Leew ‘A pots 
Lut does not pecal/ Cape ti Ce bkes . Bud coull b hove bee 
aftr 
Whew we ling woth, import N u| Chery] ' only reStoved 


AcvesS to gy export + 4ull 2upot (2x) 
thinks it wes only He Vive malleox for export. 
But Hooy al reds had access to HRC Archive ble 
me Seve teow Permission te tat pail bor 
by Gays ve call wh, hed access but nrny be Chery 


Gov 4Kpe v4 folhey deletes ~pribably Lon, Gou ep out 


Hama -gmeil-yoheo - did. lenpee ot mat {Cow hey local 
Atcount jfato He mail Sevver 
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@ 


b6 


2)8| te b7¢ 
e a trarl, Com 


Mug have. ved grreil +o CXpeut 4 mail Crom Mackosk 
Mae Mat Gvmat 
Hk Ordtlook up 4e A iiea +o pull jnthl email trom frac Mes! 
Maz hoe dome this on Ya Mdewn Servee 
4o imp ivf fhe erparted Elfans into Det ledbo 


Wanted the email to migrate Lois our Cevrver +o Grail 
Ly Wanted fast 60 doug 5 o€ emal/s 


Email Cleanups tasks - presumably related ro Sur tehiy 
+o Go dar, s of backyPs 


The cx preted. psts would hare Leen daletel fran 
the mom t Sevyver at Some pon. Doesut remace ber theo 


Power Contvo k handled v| Date bac kug » Used to of Exc horse 
(estves . “DveSnot ve.call Any ahons dane Wfroe |. 


b6 
b7C 


Geo le Ay rs M cy ret lon 
[pe Where on Gueetl (Gag Apps to Business) 
~ Allowed us te owtomrate pulls all they Emalls 


~ Dees nr ot remem ber Usivg it in Tos 
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b6 
b7C 
March ZOIS 
ee 
- Res not knw mz S@ cu rity forsurt 
7 Filters — date ree ema address 
— Clean ue 1S ow genewse term 
Shave drive on PRN Sevuws 
One. plone 
Clintesis loac lon p device thot nuded fm connect ~ Q Bhrelebrerrsf 
tales about nasdin  aocess to TWh dee’ 
b7C 


Exp ont Pst Lles Were delete d butne ve calle etio~ of Aen. 
ly Dees not Kusue if re lated to “Cleanup fasks 


uss 
NAS - Brien had been vse dov tudvoa Sts e 
vee® 
‘S86 Seyviv le Ss 
Eterna! Drive - Deo esat Kure het yr Woes Used Gav 


3 les|is - Wat eLeult backups % Vovecellection o€ W- 


Ss} [15 -Datto Chive ty Show docu t tor deletions 
- Dees not remenbe ley ying vn 


S)3 Wes ~ Sleackis. 
—Wry vat you VNe a pre vn "eo Pleachlot = 
Vay Wid wart oa Om the cere 


Gener. Ce Doce _ PST Cries Wire Shreddod ~ eve halo Leophlort 


—Candtvecall Uses Ha “ourwyte fyroe space. “Feature 


© 


— oe 


b7c 


AFIS Goexle Dpps- Doos nat vecall usieg NM Coe Gury thie 
tthe thaw sree. 
dferpis —Nevmal mamtwance schedule Sov CESC 


Aes~ Sept 2015 
© Timeline doc umount 
~ Remoyi eg wan attached malbox 
~ Pre sumably related to mamtenuance of S€vver 
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HE 


_ TUECRLATION COUT AIEED 
N18 UNCLASSIFIED Q 
dle 2e- 2016 BL grec leTeO NelOG 


b6 
2/0 &/1o PTC 


Marcl © cols: 
a uas the Javea te “y re lane! te you trom CESC TY 
Chect to See what we have 
| hecamuntnchitions — just remember Msh-lewl bre 
Security check 


oO 
2 


SIGS - check what vas there 
- Lok for backags Ahet we pay fare yisse f 
Old server Ee Think the old device § weve etl off 
Extenel NAS Live wast Mot contisnred 
D Nas —Think Het was the 2! tine we froked at it 
Cold BES  —Belices he poeered rt of 


b6 
b7C 


Does net veel! delet. an, otter fefes but UoriiTSo 
d mentor es tools, Does vot knew 7s sey. 
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FEDERAL BUREAU OF INVESTIGATION 
FOI/PA 

DELETED PAGE INFORMATION SHEET 
FOI/PA# 1353814-0 

Total Deleted Page(s) = 35 
Page 119 ~ b6 - per DOS; b7C 
Page 120 ~ b6 - per DOS; b7C 
Page 121 ~ b6 - per DOS; b7C 
Page 122 ~ b6 - per DOS; b7C 
Page 123 ~ b6 - per DOS; b7C 
Page 124 ~ b6 - per DOS; b7C 
Page 125 ~ b6 - per DOS; b7C 
Page 126 ~ b6 - per DOS; b7C 
Page 127 ~ b6 - per DOS; b7C 
Page 128 ~ b6 - per DOS; b7C 
Page 129 ~ b6 - per DOS; b7C 
Page 130 ~ b6 - per DOS; b7C 
Page 131 ~ b6 - per DOS; b7C 
Page 132 ~ b6 - per DOS; b7C 
Page 133 ~ b6 - per DOS; b7C 
Page 134 ~ b6 - per DOS; b7C 
Page 135 ~ b6 - per DOS; b7C 
Page 136 ~ b6 - per DOS; b7C 
Page 137 ~ b6 - per DOS; b7C 
Page 138 ~ b6 - per DOS; b7C 
Page 139 ~ b6 - per DOS; b7C 
Page 140 ~ b6 - per DOS; b7C 
Page 141 ~ b6 - per DOS; b7C 
Page 142 ~ b6 - per DOS; b7C 
Page 143 ~ b6 - per DOS; b7C 
Page 144 ~ b6 - per DOS; b7C 
Page 145 ~ b6 - per DOS; b7C 
Page 146 ~ b6 - per DOS; b7C 
Page 147 ~ b6 - per DOS; b7C 
Page 148 ~ b6 - per DOS; b7C 
Page 149 ~ b6 - per DOS; b7C 
Page 150 ~ b6 - per DOS; b7C 
Page 151 ~ b6 - per DOS; b7C 
Page 152 ~ b6 - per DOS; b7C 
Page 153 ~ b6 - per DOS; b7C 
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per 
per 
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per 
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XAXXXXXAXAXAXKXAXKXX XX XX XAXKXAXKAXX 


Xx Deleted Page(s) xX 
Xx No Duplication Fee X 
Xx For this Page Xx 


XXXXAXKXAXXAXXAXXAXXAXXAXKXAXKXAXKXAXX 
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Serial # of Originating Document 7G 
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Ore - US Deptof Slate | 
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(City and State) 

By s 

To Be Retumed (1 Yes No . 
Receipt Given 1] Yes T No 


Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
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C] Yes AX No 
Federal Taxpayer Information (FTI) 
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Title: | 
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(Communication Enclosing Materia!) 


Description: i Original notes re interview of 
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United States Department of State 
Office of Inspector General 


b6 
b7C 


2121 Virgipi ue, NW Phone 
Suite 8100 Email; 


Washington, DC 20037 
HRC-2506 
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ALL FBI LNECRMAT ION CONT AIE 
RESET IS UND LASSI FIED 
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aVX- 
: FD-340 (Rev. aet103)) —- ; 43 
“pile Number b7E 


“field Office Acquiring Evidence a 


Serial # of Originating Document TS 


Date Received 


: b6 
From _ b7C 
(Address) 
a (City and State) : 
b6 
By <A b7c 
To Be Retumed [J Yes pe ( No 
Receipt Given. [J Yes KA No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) % 
Federal Rules of Criminal Procedure 
. OO Yes rg No 
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ALL EBL [BPORMATION (ONTAINED 
HEREIN [a UNCLASS IE LEL 
ATE le-04-2016 BY Jfecleilso HSICL 


| (LA) (FBI) 
b6 per FBI, DOSs™ 


From: a |) a b7C per FBI, DOS 

Sent: ednesday, August 19, 201 : 

To: Wena a TD 

Subject: policy and memos 

Attachments: 11-STATE-65111.eml.pdf; 12 FAM 540. pdf; MemoPreservingEmailofSeniorOfficials. pdf; 14 
STATE 128030. pdf 


Hopes this helps. For 12 FAM 540, see 544.3. The provision on conducting day-to-day operations on an authorized 
system has been in place since 2005. ; 


b6 per FBI, DOS 
b7C per FBI, DOS 


Office of Inspector General 


U.S. reper of State 
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From: svcsmartmfi 


Sent: 6/28/2011 6:42:47 PM 


To: SMART Core 


Subject: Securing Personal E-mail Accounts 


UNCLASSIFIED 


MRN: 
Date/DTG: 
From: 
Action: 
E.0O.: 
TAGS: 
Subject: 


UNCLAS STATE 065111 
E.0. 13526: N/A 


11 STATE 65111 

Jun 28, 2011 / 2822232 JUN 11 

SECSTATE WASHDC 

ALL DIPLOMATIC AND CONSULAR POSTS COLLECTIVEROUTINE 
13526 , 

APCS, ASEC, AADP, AMGT 

Securing Personal E-mail Accounts 


TAGS: APCS, ASEC, AADP, AMGT 
SUBJECT: Securing Personal E-mail Accounts 


Reference: 


A) 12 FAM 544.3 


1. Department of State users are encouraged to check the 

security settings and change passwords of their home e-mail 
accounts because of recent targeting of personal e-mail 

accounts by online adversaries. Security guidelines have 

been posted on the DS/SI/CS Cyber Security Awareness web page: 
https://intranet.ds.state.sbu/DS/SI/CS/Awareness1/Content/Pers 


onal%20Email.aspx. 


2. Recently, Google asserted that online adversaries are 
targeting the personal Gmail accounts of U.S. government 
employees. Although the company believes it has taken 
appropriate steps to remediate identified activity, users 
should exercise caution and follow best practices in order 

to protect personal e-mail and prevent the compromise of 
government and personal information. The DS/SI/CS Cyber 
Security Awareness web site contains guides to help secure 
the web-based e-mail accounts of users and their families. 
This information can be accessed at: 
https://intranet.ds.state.sbu/DS/SI/CS/Awareness1/Content/Pers 


onal%20Email.aspx. 


3. What can you and your family members do? 
(a) Follow the personal e-mail guides posted on the Awareness 
site to change your password, to ensure that messages are not 


CLASSIFICATION: UNCLASSIFIED 
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’ 
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? 
1? 


* 


” ‘CLASSIFICATION: UNCLASSIFIED 
Page 2 of 2 


auto-forwarding to an unintended address, and to verify that 
other security settings are properly configured. 

(b) Beware of e-mail messages that include links to password 
reset web pages. These can be easily faked. 

(c) Create strong passwords for all of your online accounts, 
change them often, and never use the same password for more 
than one account. 

(d) Avoid conducting official Department business from your 
personal e-mail accounts. 

(e) Do not reveal your personal e-mail address in your work 
"Out of Office" message. 

(f) Do not auto-forward Department e-mail to personal e-mail 
accounts, which is prohibited by Department policy (12 FAM 
544.3). 


4. Questions regarding cyber security awareness should be 
addressed to awareness@state.gov 
CLINTON 
b6 per DOS 


Signature: CLINTON b7C per DOS 


Drafted By: DS/SVCS 


Cleared By: DS/DSS:JCULVER, DS/SI rr 
AF/EX: LANDRE, WHAJEX: -SCAVEX: ATEPLITZ, EUR/EX: J 


DCHRISTENSEN, IRM/OPS: STAYLOR, IRMA: JSTREUFERT, S/ES-O: NLMACKLIN 


Approved By: DS:EBOSWELL 

Info: 

XMT: AMEMBASSY TRIPOLI 
Attachments: metadata.dat 

Action Post: 

Dissemination Rule: Archive Copy 


UNCLASSIFIED 
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UNCLASSIFIED (U) 
U.S. Department of State Foreign Affairs Manual Volume 12 
Diplomatic Security 


12 FAM 540 
SENSITIVE BUT UNCLASSIFIED 
INFORMATION (SBU) | 


(CT:DS-190; 03-05-2013) 
(Office of Origin: DS/SI/IS) 


12 FAM 541 SCOPE 
(CT:DS-190; 03-05-2013) 


a. 


Sensitive but unclassified (SBU) information is information that is not classified 
for national security reasons, but that warrants/requires administrative control 
and protection from public or other unauthorized disclosure for other reasons. 
SBU should meet one or more of the criteria for exemption from public 
disclosure under the Freedom of Information Act (FOIA) (which also exempts 
information protected under other statutes), 5 U.S.C. 552, or should be 
protected by the Privacy Act, 5 U.S.C. 552a. 


. Types of unclassified information to which SBU is typically applied include all 


FOIA exempt categories (ref. 5 U.S.C. 552b), for example: 


(1) 


(2) 
(3) 
(4) 
(5) 


Personnel, payroll, medical, passport, adoption, and other personal 
information about individuals, including social security numbers and home 
addresses and including information about employees as well as members 
of the public; 


Confidential business information, trade secrets, contractor bid or proposal 
information, and source selection information; 


Department records pertaining to the issuance or refusal of visas, other 
permits to enter the United States, and requests for asylum; 


Law enforcement information or information regarding ongoing 
investigations; 


Information illustrating or disclosing infrastructure protection 
vulnerabilities, or threats against persons, systems, operations, or facilities 
(such as, usernames, passwords, physical, technical or network specifics, 
and in certain instances, travel itineraries, meeting schedules or 
attendees), but not meeting the criteria for classification under Executive 
Order (EO) 13526, dated December 29, 2009; 


(6) Information not customarily in the public domain and related to the 
protection of critical infrastructure assets, operations, or resources, 
whether physical or cyber, as defined in the Homeland Security Act, 6 
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U.S.C. 131(c); 


(7) Design and construction information; 


(a) Certain information relating to the design and construction of 
diplomatic missions abroad, such as graphic depictions of floor plans 
and specifications for foreign affairs offices and representational 
housing overseas, as outlined in the DS Security Classification Guide 
for the Design and Construction of Overseas Facilities, dated May 
2003; and 


(b) Certain information relating to the design and construction drawings 
and specifications of General Service Administration (GSA) facilities, as 
outlined in GSA Order PBS 3490.1A, dated June 1, 2009. 


(8) Privileged attorney-client communications (relating to the provision of legal 
advice) and documents constituting attorney work product (created in 
reasonable anticipation of litigation); and 


(9) Inter or intra-agency communications, including emails, that form part of 
the internal deliberative processes of the U.S. Government, the disclosure 
of which could harm such processes. 


c. Designation of information as SBU is important to indicate that the information 
requires a degree of protection and administrative control but the SBU label 
does not by itself exempt information from disclosure under the FOIA (5 U.S.C. 
552b). Rather, exemption is determined based on the nature of the 
information in question. 


12 FAM 542 IMPLEMENTATION 
(CT:DS-117; 11-04-2005) 
This policy is effective 11-04-2005. 


12 FAM 543 ACCESS, DISSEMINATION, AND 
RELEASE 
(CT:DS-161; 03-01-2011) 


a. U.S. citizen direct-hire supervisory employees are ultimately responsible for 
access, dissemination, and release of SBU material. All employees will limit 
access to protect SBU information from unauthorized or unintended disclosure. 


b. In general, employees may circulate SBU material within the Executive Branch, 
including to locally employed staff (LE staff), where necessary to carry out 
official U.S. Government functions. However, additional restrictions may apply 
to particular types of SBU information by virtue of specific laws, regulations, or 
international or interagency agreements. Information protected under the 
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Privacy Act, can only be distributed within the Department of State on a “need- 
to-know” basis and cannot be distributed outside the Department of State 
except as permitted by specific statutory exemptions or “routine uses” 
established by the Department of State. 


c. Before distributing any SBU information, employees must be sure that such 
distribution is permissible and, when required, specifically authorized. (See 5 
FAM 470.) 


d. SBU information must be marked whenever practical to make the recipient 
aware of specific controls. While some documentation, such as standard forms 
and medical records, does not lend itself to marking, many documents, such as 
emails, cables, and memoranda, can, and must be marked in accordance with 5 
FAM 751.3, 5 FAH 1 H-200 and 5 FAH-1 H 135. 


e. SBU information that is not to be released to non-U.S. citizens, including locally 
employed staff, must be marked SBU/NOFORN (Not for release to foreign 
nationals (NOFORN)). The specific requirements for SBU/NOFORN are 
identified in 12 FAM 545. 


f. Information obtained from or schanaee with a foreign government or 
international organization as to which public release would violate conditions of 
confidentiality or otherwise harm foreign relations must be classified in order to 
be exempt from release under FOIA or other access laws. The SBU label 
cannot be used instead of classification to protect such information. 


g. Where an individual has expressly. authorized his or her personal information to 
be sent unencrypted over any unsecured electronic medium, such as the 
Internet, fax transmission, or wireless phone, such information may be 
transmitted without regard to the provisions and policies set forth in this 
subchapter. See 5 FAH-4, H-442 for guidance on obtaining an individual's 
authorization to transmit personal information in this manner. 


12 FAM 544 SBU HANDLING PROCEDURES 
(CT:DS-117; 11-04-2005) 


a. Regardless of method, the handling, processing, transmission and/or storage of 
SBU information should be effected through means that limit the potential for 
unauthorized disclosure. 


b. Employees while in travel status or on temporary duty (TDY) assignment should. 
ensure that SBU is adequately safeguarded from unauthorized access in light of 
the threat conditions and nature of the SBU (see 12 FAM 544.1 d.) (This 
applies regardless of whether the information is being transported in paper 
form, CDs, diskettes and other electronic readable media, or on a portable 
digital device; such as a laptop, wireless or wired, or PDA.) 
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12 FAM 544.1 Fax Transmission, Mailing, 
Safeguarding/Storage, and Destruction of SBU 
(CT:DS-117; 11-04-2005) 


a. Unintended recipients can intercept SBU information transmitted over 
unencrypted electronic point-to-point links, such as Voice over Internet Protocol 
methodology (VoIP), telephones or faxes. 


b. Employees transmitting SBU information should consider whether specific 
information warrants a higher level of protection accorded by a secure fax, 
phone, or other encrypted means of communication. Employees transmitting 
SBU information via non-secure fax must ensure that an authorized recipient is 
ready to receive it at the other end. 


c. SBU information may be sent via the U.S. Postal Service (USPS) or a 
commercial delivery service, e.g., Fed Ex, DHL. SBU information, except 
SBU/NOFORN, (see 12 FAM 545) mailed to posts abroad should be sent via 
unclassified registered pouch or to a Military Postal Facility (MPF) via USPS, 
whenever practicable. Use of foreign mail services is authorized, if required. 
Except in those cases where the pouch is utilized, mail must be packaged in a 
way that does not disclose its contents or the fact that it is SBU. 


d. During non-duty hours, SBU information and removable electronic media in 
U.S. Government facilities must be secured within a locked office or suite, or 
secured in a locked container. Employees in possession of SBU outside U.S. 
Government facilities must take adequate precautions that afford positive 
accountability of the information and to protect SBU information from 
unauthorized access such as storage in a locked briefcase or desk in a home . 
office. SBU should not be left unsecured (e.g. lock in room safe) in unoccupied 
hotel rooms or unattended in other public spaces. 


e. Custodians of medically privileged information must ensure that it is secured 
when not in use. 


f. Destroy SBU documents by shredding or burning, or by other methods 
consistent with law or regulation. 


12 FAM 544.2 Automated Information System (AIS) 
Processing and Transmission 
(CT:DS-117; 11-04-2005) 


The requirements for processing SBU information on a Department AIS are 
established in 12 FAM 620 and 5 FAM 700. Where warranted by the nature of the 
information, employees who will be transmitting SBU information outside of the 
Department network on a regular basis to the same official and/or most personal 
addresses, should contact IRM/OPS/ITI/SI/PKI to request assistance in providing a 
' secure technical solution for those transmissions. Availability of a Public Key 
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Infrastructure (PKI) solution for a home computer will depend upon the computer's 
operating system (e.g., Windows(r) XP). Employees participating in the home PKI 
and telework program must complete the requisite training and sign an 
acknowledgement statement prior to being issued the approved security 
measures/equipment. 


12 FAM 544.3 Electronic Transmission Via the Internet 
(CT:DS-117; 11-04-2005) 


a. It is the Department’s general policy that normal day-to-day operations be 
conducted on an authorized AIS, which has the proper level of security control 
to provide nonrepudiation, authentication and encryption, to ensure 
confidentiality, integrity, and availability of the resident information. The 
Department’s authorized telework solution(s) are designed in a manner that 
meet these requirements and are not considered end points outside of the 
Department’s management control. 


b. The Department is expected to provide, and employees are expected to use, 
approved secure methods to transmit SBU information when available and 
practical. 


c. Employees should be aware that transmissions from the Department’s OpenNet 
to and from non-U.S. Government Internet addresses, and other .gov or .mil 
addresses, unless specifically directed through an approved secure means, 
traverse the Internet unencrypted. Therefore, employees must be cognizant of 
the sensitivity of the information and mandated security controls, and evaluate 
the possible security risks and then decide whether a more secure means of 
transmission is warranted (i.e., secure fax, mail or network, etc.) 


d. In the absence of a Department-provided secure method, employees with a 
valid business need may transmit SBU information over the Internet 
unencrypted after carefully considering that: 


(1). SBU information within the category in 12 FAM 541b(7)(a) and (b) must 
never be sent unencrypted via the Internet; 


(2) Unencrypted information transmitted via the Internet is susceptible to 
access by unauthorized personnel; 


(3) Email transmissions via the Internet generally consist of multipoint 
communications that are routed to their destination through the path of 
least resistance, which may include multiple foreign and U.S. controlled 
Internet service providers (ISP); 


(4) Once resident on an ISP server, the SBU information remains until it is 
overwritten; 


(5) Unencrypted email transmissions are subject to a risk of compromise of 
information confidentiality or integrity; 
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(6) SBU information resident on personally owned computers connected to the 
Internet is generally more susceptible to cyber attacks and/or compromise 
than information on government owned computers connected to the 
Internet; 


(7) The Internet is globally accessed (i.e., there are no shvsleal or traditional 
territorial boundaries). Transmissions through foreign ISPs or servers can 
magnify these risks; and 


(8) Current technology can target specific email addresses or suffixes and 
content of unencrypted messages. 


e. SBU information must not be posted on any public Internet website, discussed 
in a publicly available chat room or any other public forum on the Internet. 


f. To preclude inadvertent transmission of SBU information prohibited on the 
Internet, AIS users must not use an “auto-forward” function to send emails to 
an address outside the Department’s network. 


g. SBU information created on or-downloaded to publicly available non- U.S. 
Government owned computers, such as Internet kiosks, should be removed 
when no longer needed. 


h. All users who process SBU information on personally owned computers must 
ensure that these computers will provide adequate and appropriate security for 
that information. This includes: 


(1) Disabling unencrypted wireless access; 
- (2) The maintenance of adequate physical security; 
(3) The use of anti-virus and spyware software; and 


(4) Ensuring that all operating system and other software security patches, 
virus definitions, firewall version updates, and spyware definitions are 
current. 


12 FAM 544.4 SBU Transmission Between State. 
Department Facilities 
(CT:DS-117; 11-04-2005) 


All SBU transmissions between Department facilities must be encrypted to current 
NIST, DS, and IT CCB standards. 


12 FAM 545 SBU/NOFORN INFORMATION 
(CT:DS-117; 11-04-2005) 


a. SBU/NOFORN information is information determined by the originator or a 
classification guide to be prohibited for dissemination to non-U.S., citizens. It 


must be labeled SBU/NOFORN. 
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b. As the NOFORN caveat indicates, this type of SBU information warrants a 
degree of protection greater than that of standard SBU information. Therefore, 
employees must: 


(1) Process and transmit SBU/NOFORN information only on a system 
authorized by the Department for classified information transmission, 
storage and processing; 


(2) Fax or discuss (over telephone lines) SBU/NOFORN information only via 
encrypted telephone lines; 


(3) Mail SBU/NOFORN information to posts via classified pouch or to a MPF via 
USPS registered mail. Mail sent via USPS registered must be packaged in a 
way that does not disclose its contents or the fact that it is SBU/NOFORN; 


(4) Secure SBU/NOFORN information during non-duty hours following the 
same guidelines for CONFIDENTIAL information; and 


(5) Destroy SBU/NOFORN documents in a Department-approved manner, such 
as by shredding, burning, or other methods consistent with law or 
regulation for the destruction of classified information. 


12 FAM 546 THROUGH 549 UNASSIGNED 
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From: SMART Archive 
Sent: 10/30/2014 6:57:49. PM 

To: ‘ALL DIPLOMATIC. AND: CONSULAR POSTS COLLECTIVE; SVCSMARTBTSPOP8 
Subject: ‘State. Depatiment Records. Responsibilities. and Policy. 


UNCLASSIFIED 

MRN: 44 STATE 128030 
Date/DTG: Oct 30, 2014 t 302301Z OCT 14, 
From: SECSTATE WASHDC 
Action: ALL DIPLOMATIC. AND CONSULAR: POSTS: COLLECTIVE ROUTINE 
£0. 43526: 
TAGS: AINF, AMGT, ASEC 
Pass Line: INFORM,CONSULS 

‘FROM THE. UNDER SECRETARY FOR. MANAGEMENT, PATRICK F, KENNEDY: 
Subject: State Department Records:Responsibilities and Policy. 


1. As the Senior Agency Official (SAO) for records, it is my responsibility to 


ensure that we maintain the documentation of all that we-do in the performance :of 
our official duties, not only because it is. required by law and is a+ good: business 


practice, but because it is the right. thing to do. 


2. The Office of Management. and Budget (OMB) and ‘the National Archives and 


Records Administration (NARA) have: recently issued, joint guidahce on managing, 


email, that is consistent with, Department policy, This guidance serves as a 
reminder: to ALL employees regardless of rank .or: position -- including Foreign 


Servite and Civil ‘Service, employees, contractors, When Actually. Employed. (WAES) 
employees, and Locally Employed Staff (LES) of the Department, -~ that ‘we are - 


responsible for creating records necessary to document ‘our activities, in addition 


to the proper management and preservation. of records. These responsibilities are 


applicable to¢ all reéords made or ‘recéived in the conduct of agency business, 
regardless of physical format or media, including .é-mail. 


‘3. In short, as a condition of our employment with the USG, employees at every 


level have both a legal responsibility and_a business obligation to ensure that 


the’ documentation of their official duties is captured, preserved, managed, 


protected and accessible in official government systems. This includes email. 
4 Through. Presidential. initiatives and undér thé leadership of -OMB and NARA, 


‘this ‘Administration is moving aggressively to: ensure we capture the essential 


documentation : ‘Of: what we do- for ourselves and for posterity. It's important for. 
you. to know. that: the ‘public appetite: for our contemporary records is- huge. The- 


nistorical récords-of tHe. State Department afte the. most acceSséd of all ‘the agency 


wwecords archived. at. the National Archives.. So, in continuing ‘our long ‘standing 


tradition of record keeping - of preserving: our history - it is imperative. we. 
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leverage new technologies. to ensure officials. and the public today, as: well as 
future genérations, will know. what we have done to promote our foreigh policy 
mission with its related programs, Gperattong and. activities. 


5. With that in mind, we recéntly reminded senior officials: and othér ‘selected 
employees. of théir records responsibilities, and provided instructions: for 
preserving the e-mail of senior pe riciats: See 14 STATE. 111506: and «my August 28, 
2074 ‘meniorandum, “Senior Officials ‘Records; Management Responsibilities. "& Both: 
‘aye available on the Departmerit’s Records Management website. 


6. While employees, including senior officials, may delete personal. e-thails,. they. 
‘should be. aware that the definition of a personal e-mail. is very narrow. The. only: 
e-mails that aré. personal of non-reéord aré those that dé not. relate to or affect: 
the transaction of Government business. Departing employees :are also reminded 
‘they: may take with: them only personal papers and non-record materials, subject to, 
review by records officers t6. ensure compliance with federal records laws and 
regulations: All federal records génerated by employees, including senior 
officials, belong to the Department of State. 


7. %In addition to. the responsibility for preserving the documentation of official 
activitiés insofar as it is captured in email, employees’ generally should not use 
private e-mail accounts (e.g., Gmail, AOL, Yahoo, etc.) for official business. 
‘However, in those very limited ‘circumstances when it becomes necessary to do so, 
‘thé émail messages’ covering official business sent. from or receivéd in a personal 
account must be captured and preserved in one of the Department's official 
electronic records’ systems (i.e. ' SMART or POEMS) . The best way for employees ‘to. 
‘ensure this isto forward e-mail. messages froma private account to their 
réspéctive Staté account. Private email accounts should not be used for 
Classified information. 


8. I appreciate your cooperation in adhering to this policy guidance. This is an 
@ésséntial part of your official. respdnsibilitiés. Further instrué¢tions will ‘bé 
forthcoming, as well as codification of this policy in the FAM. Should: you, have 
any questions, please ‘address: them to Records-DLestate. govV.-or visit ‘the 
Department's Records Management website for more information. ‘As part of the. 
Department’S récords management responsibility there is an on-going effort, to 
promulgate guidance that covers such, technologies as: email, instant messaging, 
social media and other online tools that are becoming more widely used. 


Signature: Kerry 

Drafted By: A/GIS:: MPGRAFELD 

Cleared By: A:JBARR A/GIS:MPGRAFELD A/GIS/IPS ACTING:JHACKETT 
AIGIS, WFISCHER M/PRI-ATEPLITZ H:CDUVAL AF/EX:MTABLER-STONE 
DSIS P/EX:KSTANTON 


EUR-IO/EX:JARBIN L:RVISEK,NEA-SCA/EX:PHOFFMAN+ 


b6 per DOS 
WHAVEX: ‘ARAN A/EX:JDEGARMO AFO: DWHITTEN S/ES-O: MTOUSSAINT 


b7C per DOS 


WASHDC\WVareroE 
Approved By: M:KAUSTIN-FERGUSON 
Released By: IRM_OPS_MSO:Jarero, Eduardo 
Dissemination Rule: Archive Copy 
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UNCLASSIFIED 
MEMORANDUM TO: 
From: 


201412443 Rev. 1 


United States Department of State 


Under Secretary of State 
for Management 


Washington, D.C. 20520 
AUG 28 2014 


The Office of the Secretary 

The Office of Deputy Secretary Burns 

The Office of Deputy Secretary for Management and 
Resources Higginbottom 

The Director of Foreign Assistance 

All Under Secretaries 

C- The Office of the Counselor 

All Assistant Secretaries 

L-— The Office of the Legal Advisor 

S/CPR — Peter Selfridge 

S/P — David McKean 

All Special Representatives and Special Envoys 

cc: Executive Directors 


C- 
M - Patrick F. Kennedy ie 


SUBJECT: Senior Officials’ Records Management Responsibilities 


Senior officials are responsible for creating records necessary to document 
their activities and for the proper management and preservation of their records 
(see Tab 1 for the list of Senior Officials to which this memorandum is directed). 
These responsibilities are applicable to all records made or received in the conduct 
of agency business regardless of physical format or media. While all Department 


employees are to preserv 
Federal Records Act, see 


e records meeting the definition of a record under the 


3 FAM 414.8, senior officials’ records are generally the 


most important documents created within the Department and are some of the most 
valued documents archived at the National Archives and Records Administration 
(NARA). Proper records management ensures statutory and regulatory 
compliance, preserves the rights of the government and citizens, supports better 
decision making, safeguards vital records, preserves organizational memory, 
minimizes litigation risk (ensuring systematic, documented, and routine disposal of 
records), and reduces operating costs through control over the lifecycle of the 


records. 
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Specifically, senior officials must create records necessary to document their 
activities and actions taken on behalf of the Department. A records custodian must 
be identified who can manage a particular senior official’s records in support of 
proper records lifecycle management, including appropriate access. Departing or 
transferring Senior Officials must identify their records prior to departure or 
transfer. Departing Senior Officials are reminded they may take with them only 
personal papers and non-record materials, subject to review by records officers to 
ensure compliance with federal records laws and regulations. All records 
generated by Senior Officials belong to the Department of State. 


Defining and Managing Records 


Records may exist in many formats, including Instant Messages (IM) and 
records on mobile devices like BlackBerries, mobile phones, and iPads. Typical 
records created by Senior Officials include not only e-mails, memos, and similar 
documents, but also calendars, schedules, and logs of daily activities. 
Additionally, Senior Official records should include the following: 

o Records pertaining to various committees, including Federal Advisory 
Boards, councils, and inter-agency and external committees in which the 
Senior Official participated. 

o Materials relating to internal and external meetings, including briefing 
documents, minutes, and meeting notes. 

o Records documenting the development of Department policies and 
programs, including correspondence, briefing and issue papers, and reports 
about policy, strategy, research and legislative priorities, program evaluation 
and planning, and similar topics. 

o Reports to Congress and/or the President. 


To establish a sound records management program, Senior Officials should, at 
minimum, take the following steps: 

o Designate a records manager responsible for their records. 

© Follow established records disposition schedules, which set out the 
applicable records retention and disposition requirements. 

o Establish a plan for maintaining and managing their records. 

o Collect, organize, and categorize their records in order to facilitate their 
preservation, retrieval, use, and disposition. 


Specific Email Requirements and Procedures 
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E-mail is the most widely-used tool within the Department for the conduct 
of official business. The Department generates millions of e-mail communications 
each year, many of which document significant foreign policy and Department 
business decisions. The standard for determining whether an e-mail message 
meets the definition of a “record” under the Federal Records Act is the same 
standard that applies to all other types of Department records (S FAM 443.2 — see 
Tab 2). 


As a supplement to existing policy, and consistent with the policy in place 
since 2009, it is important to capture electronically the e-mail accounts of the 
senior officials listed in Tab 1 as they depart their positions. Instructions for senior 
officials are provided (see Tab 3). . 

o Atno time during designated senior officials’ tenure will their e-mail 

accounts be cleared, deleted, or wiped for any reason. 

o While senior officials may delete personal e-mails, they should be aware 
that the definition of a personal e-mail is very narrow. The only e-mails 
that are personal are those that do not relate to or affect the transaction of 
Government business. 

o Asageneral matter, to ensure a complete record of their activities, senior 
officials should not use their private e-mail accounts (e.g., Gmail) for 
official business. If a senior official uses his or her private e-mail 
account for the conduct of official business, she or he must ensure that 
records pertaining to official business that are sent from or received on 
such e-mail account are captured and maintained. The best way to ensure 
this is to forward incoming e-mails received on a private account to the 
senior official’s State account and copy outgoing messages to their State 
account. 


Visit the Department’s Records Management website for more information. 


Attachments: 
Tab 1 — List of Designated Senior Official Positions 
Tab 2—5 FAM 443.2 (Which E-mail Messages Are Records) 
Tab 3 ~ Instructions for Preserving E-mail of Departing Senior Officials 
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DRAFT: Designated Senior Official Positions - March 5, 2014 


*The positions identified below reflect NARA guidance to satisfy the Presidential Directive on 
retaining Email for Senior Officials. The Electronic Records Management Working Group will 
subsequently address the companion NARA guidance for retaining all other. Email. 


Secretary of State 

Deputy Secretary 

Under Secretary 

Assistant Secretary (AS). 

Regional Deputy Assistant Secretary 
Principal Deputy Assistant Secretary 
(PDAS) 

Chief of Staff 

Deputy Chief of Staff 

Executive Secretary 

Deputy Executive Secretary 
Executive Assistant to the Principal 
Officers 

Policy Advisor 

Strategic Advisor 

Chief Speechwriter 

Director of Communications 
Director of Foreign Assistance 
Director of M/PRI 

White House Liaison 

Chief Financial Officer 

Chief Economist 

Chief Information Officer 

Chief of Protocol 

Assistant Chief of Protocol 

Deputy Chief of Protocol 
Counselor 

Comptroller 

Legal Adviser 

Deputy Legal Adviser 

Assistant Legal Adviser 

Counselor on International Law 
Special Assistant to the Legal Adviser 
Principal Deputy Legal Adviser 
Inspector General 

Deputy Inspector General 

Counsel to the Inspector General 
Geographer 


Senior Advisers to the Erocipale 
Ambassador 

Ambassador-At-Large - 

Chief of Mission 

Charges d’ Affaires 

Charges d’ Affaires ad interim 
Consuls General 

Consuis 

Principal Officer of US. Interest 
Sections 

Deputy Chief of Mission 

Deputy to the Ambassador-At-Large 
Deputy Principal Officers 

Assistant Chiefs of Mission 

Special Envoy 

Deputy Special Envoy 

Special Representative 

United States Permanent Representative 
United States Representative 

United States Deputy Representative 
Alternate Representative 


All individuals formally designated (i.e. 
by memorandum) as “Acting” in the 
above listed positions 


e Applicable Special Assistants and Staff 
Assistants to the above listed positions, 
when they receive and respond to emails 
on the Senior Official’s behalf 


**Beyond this list, Bureaus may determine at an 
office level which individual positions would be 
considered “Designated Senior Official 
Positions” for the purposes of email 
preservation. 


Accountability Review Board Members 
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5 FAM 440 
_ ELECTRONIC RECORDS, FACSIMILE 
- RECORDS, AND ELECTRONIC MAIL RECORDS 


(CT:IM-126; 02-28-2012) 
(Office of Origin: A/GIS/IPS) 


5 FAM 441 ELECTRONIC RECORDS MANAGEMENT 
(TL:IM-19; 10-30-1995) 
These requirements apply to all electronic records systems: microcomputers; 


minicomputers; and mainframe computers in networks or. stand-alone 
configurations, regardless of storage media. 


a. Electronic Data files. 
(1) Those employees who are responsible for designing electronic records | 


systems that produce, use, or store data files, shall incorporate 
disposition instructions for the data into the design plan. 


(2) System Administrators must maintain adequate and current technical 
documentation for electronic records systems that produce, use, or store 
data files. At a minimum, include: . . 


(a) a narrative description of the system (overview); 


(b) a-records layout that describes each field, its name, size, starting or 
relative position; 


(c) adescription of the form of the data (e.g., alphabetic, zoned 
decimal, packed decimal or numeric) or a data dictionary. Include 
the equivalent information and a description of the relationship 
between data elements in the data bases when associated with a 
data base management system; and 


(d) any other technical Information needed to read or process the 
records. 


(3) Electronic data bases that support administrative or housekeeping 
functions and contain information derived from hard copy records 
authorized for disposal may be deleted if the hard copy records are 
maintained in official files. . 


(4) Data in electronic form that is not preserved in official, hard copy files or 
supports the primary program or mission of an office, even if preserved in 
official hard copy files, may not be deleted or destroyed except through 
authorities granted as prescribed in sections h. and i. below. 
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b. Documents. 


(1) Electronic records systems that maintain the official flle copies of 
documents shall provide a capability for the disposition of the 
documents. This includes the requirements for transferring permanent 
records to the National Archives, when necessary. 


(2) Electronic records systems that maintain the official file copy of 
documents shall Identify each document sufficiently to enable authorized 
personnel to retrieve, protect, and carry out the disposition of documents 
in the system. Appropriate identifying Information may include: office of 
origin, TAGS/Terms, subject line, addressee (if any), signatory, author, 
date, security classification, and authorized disposition. 


(3) Electronic records systems that maintain the official file copy of 
~ documents shail provide sufficient security to ensure document integrity. 


(4) Documents such as letters, messages, memorandums, reports, 
handbooks, directives, and manuals recorded on electronic media may be 
deleted if the hard copy record is maintained in official files. 


(5) Documents such as letters, messages, memorandums, reports, 
handbooks, directives, and manuals recorded and preserved on electronic 
media as the official file copy shall be deleted in accordance with 
authorized disposition authorities for the equivalent hard copy. If the 
authority does not exist, the documents in electronic form may not be 
deleted or destroyed except through authorities granted as prescribed in 
sections h. and j. below. 


Spreadsheets. 


(1) Spreadsheets recorded on electronic media may be deleted when no 
longer needed to update or Pocus hard copy if the hard copy record is 
maintained in official files. 


(2) Spreadsheets recorded and preserved on electronic media shall be 
deleted in accordance with authorized disposition authorities for the 
equivalent hard copy. 


d. Electronic records are acceptable as evidence in federal courts. Rule 803 (6), 

Federal Rules of Evidence, has been interpreted to include computer records. 
Further under Rule 1006, summary electronic records may be provided to limit 

the quantity of Information considered during judicial proceedings. The courts 
must believe that records admitted before It are “trustworthy” that Is, they 
must clearly and accurately relate the facts as originally pincer or in 
summary form. 

e. Administrators of electronic records systems shall ensure that only authorized 
personnel have access to electronic records. 


f. Administrators of electronic records systems shall provide for the backup and 
recovery of records. 


c 
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g. Administrators of electronic records systems shall make certain that storage 
media meet applicable requirements prescribed in 36 CFR 1234.28. These 
requirements are also contained in FIRMR Bulletin B-1 and are discussed in the 
RMH, 5 FAH-4 H-219 . 

h. Retention of electronic records. 


(1) The information in electronic records systems and related documentation 
and indexes must be scheduled for disposition no laterithan one year 
after the Implementation of the system. | 


(2) Procedures must be established for systematically backing up, copying, 
reformatting, and providing other necessary maintenance for the 
retention and usability of electronic records throughout their prescribed 
life cycles. 


i. Destruction of electronic records. | 


(1) Electronic records may be destroyed only in accordance with a records 
disposition authority approved by the Archivist of the United States. This 
authority is obtained through the Records Management Branch 
(OIS/RA/RD). . : 

(2) This process is exclusive, and records of the United States Government, 
including electronic records, may not be alienated or destroyed except 
through this process. 


(3) Electronic records scheduled for destruction must be disposed of in a 
manner that ensures protection of any sensitive, proprietary or national 
security information. Magnetic recording media are not to be reused if 
the previously recorded information can be compromised in any way. 
Refer to 12 FAM for requirements regarding the security of magnetic 
media. 


j. All automated information systems (AIS) or facsimile machines used to process 


or store electronic records must comply with the security regulations contained 
in 12 FAM. | 


5 FAM 442 FACSIMILE RECORDS 
(TL:IM-19; 10-30-1995) 


The use of facsimile (FAX) equipment in appropriate and cost-effective 
circumstances is encouraged in the Department. Facsimile transmissions have the 
same potential to be Federal records as any other documentary materials received 
in Federal offices. The method of transmitting a document does not relieve 
sending or receiving offices of the responsibility for adequately and properly 
- documenting official actions and activities and for ensuring the Integrity of 
records. See the RMH, 5 FAH-4 , for more guidance on facsimile records. See 5 
for policies on FAX transmissions, including use of secure FAX equipment 
and using FAX equipment to send correspondence to members of Congress. 
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5 FAM 442.1 Facsimile Label 

(TL:IM-19; 10-30-1995) . . ae 

The Records Management Branch (OIS/RA/RD) has designed a facsimile 
transmission label (Form DS-1905), to be affixed to facsimile equipment. The 
label serves as a reminder to users of the responsibility to file record coples of 


facsimiles and to photocopy record copies of thermal paper facsimiles onto plain 
paper for filing. The labels are available from OIS/RA/RD. 


5 FAM 442.2 FAX Transmittal Forms 

(TL:IM-19; 10-30-1995) 

a. Form DS-1890, Unclassified Facsimile Transmittal Cover Sheet, and Form DS- 
1890-A, Classified Facsimile Transmittal Cover Sheet, are Department forms 
that are available for use in transmitting documents. Their use Is not 
mandatory. These forms are available on the INFOFORMS disk, which is part of 


the Department's INFOEXPRESS application. At a minimum, the transmittal 
form which is used by an office, should contain the following information: 


—date of transmittal 


—sending and receiving office Information (symbol, name, voice & fax 
telephone numbers) 


—subject information, including TAGS/Terms to help properly file the 
documents 


—any comments regarding the transmission 
—appropriate security classification, when using a secure fax machine. 


b. Transmittal cover sheets containing substantive comments are to be filed with 
related record material. Those containing informal messages can be destroyed 
upon receipt or when no longer needed. ) . 


5 FAM 443 ELECTRONIC MAIL (E-MAIL) 
RECORDS | : 


5 FAM 443.1 Principles Governing E-Mail 

Communications 7 

(TL:IM-19; 10-30-1995). : 

a. All Government employees and contractors are required by law to make and 
preserve records containing adequate and proper documentation of the 


~ organization, functions, policies, decisions, procedures, and essential 
transactions of the agency (Federal Records Act, or “FRA,” 44 U.S.C. 3101 et 
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seq). In addition, Federal regulations govern the life cycle of these records: they 
must be properly stored and preserved, available for retrieval, and subject to 


appropriate approved disposition schedules. 


b. As the Department’s information modernization program goes forward, new 
forms of electronic communications have become increasingly available within 
the Department and between the Department and overseas posts. One 
example of the improvements that modernization has brought is the automatic 
electronic preservation of departmental telegrams. Employees are reminded 
that under current policy departmental telegrams should be used to convey 
policy decisions or instructions to or from posts, to commit or request the 
commitment of resources to or from posts, or for official reporting by posts. 


c. Another important modern improvement is the ease of communication now 
afforded to the Department world-wide through the use of E-mail. Employees 
are encouraged to use E-mail because it Is a cost-efficient communications 
tool. All employees must be aware that some of the variety of the messages 
being exchanged on E-mail are important to the Department and must be 
preserved; such messages are considered Federal records under the law. The 
following guidance is designed to help employees determine ‘which of their E- 
mail messages must be preserved as Federal records and which may be 
deleted without further authorization because they are not Federal record 


materials. 


5 FAM 443.2 Which E-Mail Messages are Records 
(TL:IM-19; 10-30-1995) | 
a. E-mail messages are records when they meet the definition of records in the 


Federal Records Act. The definition states that documentary materials are 
Federal records when they: 


—are made or received by an agency under Federal law or in connection 
with public business; and 


—are preserved or are appropriate for preservation asievidence of the 
organization, functions, policies, decisions, procedures, operations, 
or other activities of the Government, or because of the 
informational value of the data in them. 


b. The Intention of this guidance Is not to require the preservation of every E-mail 
message. Its purpose is to direct the preservation of those;messages that 
contain information that is necessary to ensure that departmental policies, . 
programs, and activities are adequately documented. E-mail message creators 
and recipients must decide whether a particular message is appropriate for 
preservation In making these decisions, all personnel should exercise the 


same judgment they use when determining whether to retain and file paper 
records. 


c. Under FRA regulations (36 CFR 1222.38), principal categories of materials, 
including E-mail, that are to be preserved are: 
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—records that document the formulation and execution of basic policies 
and decisions and the taking of necessary actions; 


—records that document important meetings; 


—records that facilitate action by agency officials and their successors In 
office; 


—records that make possible a proper scrutiny by the Congress or other 
duly authorized agencies of the Government; and 


—records that protect the financial, legal, and other rights of the 
Government and of persons directly affected by the Government's 
actions. ¥ 


d. For example, just like paper records, E-mail messages that may constitute | 
Federal records include: 


(1) &-mail providing key substantive comments on a draft action 
memorandum, if the E-mail message adds to a proper understanding of 
the formulation or execution of Department action; 


(2) E-mail providing documentation of significant Department decisions and 
commitments reached orally (person to person, by telecommunications, 
or in conference) and not otherwise documented in Department files; 


(3) E-mail conveying information of value on Important Department activities, 
e.g. data on significant programs specially compiled by posts in response 
to a Department solicitation, if the E-mail message adds to a proper 
understanding of Department operations and responsibiilties. 


5 FAM 443.3 How to Preserve E-Mail Records 

(TL:IM-19; 10-30-1995) | 

For those E-mail messages and attachments that meet the statutory definition of 
records, it is essential to ensure that the record documentation Include the E-mail 
message, any attachments, and essential transmission data (ie. who sent the 
message, the addressees and any other recipients, and when it was sent). In 
addition, information about the receipt of messages should be retained if users 
consider it necessary for adequately documenting Department activities. If 
transmission and necessary receipt data is not printed by the particular E-mail 
system, the paper copies must be annotated as necessary to Include such data. 
Until technology allowing archival capabilities for long-term electronic storage and 
retrieval of E-mail messages is available and installed, those messages warranting 
preservation as records (for periods longer than current E-mail systems routinely 
maintain them) must be printed out and filed with related records. Instructions for 
printing and handling of Federal! records for most of the Department’s existing E- 
mail systems have been prepared and will be available through bureau Executive 
Offices 
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5 FAM 443.4 Records Management Reviews 
(TL:IM-19; 10-30-1995) , | 


The Department’s Records Management Office (OIS/RA/RD) conducts periodic 

reviews of the records management practices both at headquarters and at 

overseas posts. These reviews ensure proper records creation, ‘maintenance, and 

disposition by the Department. These periodic reviews now will include monitoring 
of the Implementation of the Department's E-mail policy. 


5 FAM 443.5 Points to Remember About E-Mail 
(TL:IM-19; 10-30-1995) | 
—Department E-mail systems are for official use only by authorized personnel. 
—The information in the systems Is Departmental, not personal. No expectation | 
of privacy or confidentiality applies. 


—Before deleting any E-mail message, apply these guidelines to determine 
whether it meets the legal definition of a records and if so, print it. 

—Be certain the printed message kept as a record contains the essential. . 
transmission and receipt data; if not, print the data or annotate the printed 
copy. . | 

—File the printed messages and essential transmission and receipt data with 
related files of the office. | 

—Messages that are not records may be deleted when no longer needed. 

—Certain E-mail messages that are not Federal records may stil be subject to 
pending requests and demands under the Freedom of Information Act, the 
Privacy Act, and litigation and court orders, and should be preserved until no 
longer needed for such purposes. - | 

—Classified Information must be sent via classified E-mail channels only, with the 
proper classification identified on each document. 


—When E-mail is retained as a record, the periods of its retention is governed by 
records retention schedules. Under those schedules, records are kept for 
defined periods of time pending destruction or transfer to the National Archives. 


5 FAM 443.6 Future Technology 
(TL:IM-19; 10-30-1995) 


a. The Department is actively working to develop systems that will enable those E- 
mail messages that are official records to be preserved electronically. 


b. These regulations are in compliance with those set forth by the National 
Archives and Records Administration. . ' 
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c. The Department and all posts are requested to bring these regulations to the 
attention of all Department employees and contractors and to begin its 
implementation immediately. 


5 FAM 444 THROUGH 449 UNASSIGNED 
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2) 


3). 


4) 


5) 
6) 
7) 


8) 


9) 


Instructions for Preserving Email of 
Departing Senior Officials 
August 2014 


As part of the employee check-out process, Executive Directors and Post Management 
Officers must notify their system administrators of the departure of designated Senior 
Officials and direct the system administrators to replicate the Offi cial’s|remaining email 
onto CDs according to the following directions. If possible ask departing Officials to delete 
truly personal emails (to/from family, friends, and other non-work related emails) from their 
inbox, sent mail and EST: folders. 


Note, preceding the Senior Officials’ departure, at no time during their tenure in a position 
will their email account be deleted, cleared, or wiped for any reason. If, for instance, they 
reach their maximum allotted space in their mailbox, the Executive Director, Post 
Management Officer, and the system administrator will work constructively with the Senior 
Official to move older emails into stable and secure storage until the check-out process — 
delineated in Instruction | is initiated. 


System administrators must disable (but NOT delete) the OpenNet, ClassNet, POEMS and 
PACE Active Directory (AD) accounts of departing Officials. 


System administrators do NOT delete the OpenNet, ClassNet, POEMS and PACE email 
accounts of departing Officials. 
| 


System administrators DO hide (but not remove) names of departing Officials from GALs. 
System apininstators DO delete the names of departing Officials nome 


Executive Directors, Office Directors or equivalent (Domestic Offi teaey or Management 
Counselors/Officers (Posts) must provide A/GIS/IPS/RA (by OpenNet mail to Records- 
DL@state.gov) with (a) the name of departed officials, (b) the designated Bureau/Post 
Records Management Coordinator, and (c) the Bureau/Post System Administrator. After the 
information is copied to the CDs, the bureau/post must verify that ane CDs are readable 
before sending. 


System administrators should create CDs for each OpenNet, ClassNet, POEMS and PACE 
email account of departed Officials. One set must be created for retirement, using the form 
DS-693, to A/GIS/IPS/RA for records preservation; the other is for Bureau/Post t use, if 
required. See the How to Retire Records page of the DOS Records Manpuement intranet 
site for further guidance on retiring records using the DS-693: 
http://a.m.state.sbu/sites/gis/ips/RA/Pages/RetiredRecords.aspx. 


System administrators must use the following .PST naming conventions: 
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a. For “Mailbox” content, use the user name followed by “_ MB”. 

b. i.e., Smith_ John H_MB. If the mailbox exceeds the capacity of one CD, use: 
Smith_ John H_ MBI for the first .PST created by the system administrator and 
Smith_ John H_MB2 for the second .PST created by the system administrator, 
etc. (System administrators can decide where/how to split the content among 
multiple CDs.) 

c. For existing (user created) -PSTs, aka “personal folders”, (this i is a misnomer used 
by Microsoft since the content is “official”, not “personal”), use the user name 
followed by “_PF” i.e. Smith, John H_PF . If the existing PSTs exceed the 
capacity of one CD, or there are multiple .PSTs, use Smith, John H_PF I for the 
first PST, Smith, John H_PF2 for the second .PST, etc. (System administrators 
can decide where/how to split the content among multiple CDs.) 


10) CD markings: 


a. CDs from OpenNet, POEMS and PACE should be marked “BU? (i.e., content 
not intended for public disclosure in accordance with 12 FAM 5400). CDs from 
ClassNet must be market "Secret" (12 FAM 632.1-6). 

b. CDs must be marked with the user’s name and office symbol or Post (example: 
John H. Doe, IRM/OPS/MSO). 

c. CDs must be marked with the users SMTP address (example jdoe sate gov or 
jdoe@state.sgov.gov). 

d. Inthe event .PST exceeds one CD, the CDs must include X of ¥ (example, | of 
3.) 


' 


11) Distributed System Administrator roles: 


_a. IRM will handle CD production for email accounts of users under IT Desktop 

Consolidation. 

b. Bureau/Office system administrators will handle CD production for email 
accounts that are NOT managed under IT Desktop Consolidation. 

c. Post system administrators should handle CD production for their email accounts. 

d. IRM’s IT Service Center ( IT Service Center@State.gov or (202) 647-2000) will 
be available to assist Post and Bureau system administrators with technical 
support for the PST and CD creation process. 


12) System administrators must NOT delete the source mailbox or PST, fi les until after 
receipt of an email confirmation from A/GIS/IPS/RA and authorization to delete. 


13) Technical questions relating to the CD creation can be sent to the IT Service Center on 


OpenNet at ]TServiceCenter@state,gov or on ClassNet to 


ITServiceCenter@state.sgov.gov or by calling 202-647-2000. Other questions can be 
sent to A/GIS/IPS/RA on OpenNet at records-di@state,gov or on ClassNet at 


records-dl@state,sgov.gov . 


NOTE: Transferring records through Direct Network Transfer is af/se an available option 
for the emails of Senior Officials. For assistance, please contact records@state.gov. 
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“ALL 2B [N2ORMATION (ONTAlNED 
HEREIN 1a UNCLASS IE IED 
ele le-O04-2015 By J fecleilso HSlLL 


| (co) (FBI) . - an 
arrears | | ee ee 
From: ; b7C per DOS, FBI 


Sent: 7, 2015 6:08 PM 

To: (CD) (FBI) 

Subject: Follow-up 

Attachments: Leopoid v State 15-123 Ntc of Decl re Release of HRC. Emails ECF Copy.pdf; Leopold v State 


15-123 ECF No 022 JSR re July 31 release. pdf 


b7C 
Here is some of the information | promised you: 


1.1 am enclosing for your information the attached declaration and status report for the Leopold FOIA litigation case 
which describes the Department’s review process for the 55K pages. This includes a description on how we are using 
the IC’s reviewers. 


2. April 28, 2015--The date of the meeting with DOJ/Fed Programs, the staff of the Office of Legal Advisor and my staff — 
wher said that she did not understand what was taking so long with the FOIA review of the 296 emails 
" relating to Benghazi. She repeatedly stated that the emails had already gone through the inter-agency review process 
and there were nothing classified in them. - BE per DOS 
b7C per DOS 


Office of Information Programs and Services Ts 
Bureau of Administration 

Department of State 

SA-2, Roo 

Washington, DC 20520 


b6 per DOS, FBI 
b7C per DOS, FBI 


202-261-8590 (fax) 
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ALL INFORMATION CONTAINED 
HEREIN IS WICLASSIFIED 
HATE 12-05-2016 BY J76318TS0 NSICG 
UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


JASON LEOPOLD, 


Plaintiff, 
v. Civil Action No. 15-cv-123 (RC) 
U.S. DEPARTMENT OF STATE, . 


Defendant. 


NOTICE OF FILING DECLARATION OF JOHN F. HACKETT 
Please take notice that attached herewith is the Declaration of John H. Hackett, Acting 
Director of the Office of Information:Programs and Services of the U.S. Department of State (the 
“Department”, filed in support of the Court’s order that “at or before the May 19, 2015 status 
hearing, the Department of State shall provide a proposed schedule of production for Secretary 
Clinton’s emails.” ECF No. 10. As set out more fully in the attached declaration, the 
| Department plans to produce releasable portions of Secretary Clinton’s emails, via the 


Department’s production of the emails to the public on its FOIA website, by January 15, 2016. 
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Date: May 18, 2015 ~ Respectfully submitted, 


BENJAMIN C. MIZER 
_ Acting Assistant Attorney General 


MARCIA BERMAN 
Deputy Branch Director 


_ Ls/ Robert J. Prince 
ROBERT J. PRINCE (D.C. Bar No. 975545) 
United States Department of Justice 
Civil Division, Federal Programs Branch 
20 Massachusetts Ave., N.W. 
Washington, DC 20530 
Tel: (202) 305-3654 
robert.prince@usdoj.gov 


Counsel for Defendant 
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ALL [NORD ATION CONTAINED 
HEBEL 15 UNCLASS IP IE) 
UATE 12-05-2016 By CyeJletec Nelle 


UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


JASON LEOPOLD, 
Plaintiff, 
Vv. No. 1:15-cv-000123-RC 


U.S. DEPARTMENT OF STATE, 


Defendant. 


DECLARATION OF JOHN F. HACKETT | 
Pursuant to 28 U.S.C. § 1746, I, John F. Hackett, declare and state as follows: | 
1. I am the Acting Director of the Office of Information Programs and Services 
(“IPS”) of the United States Department of State (the “Department”). In this capacity, I am the 
Department official immediately responsible for responding to requests for records under the 
Freedom of Information Act (the “FOIA”), 5 U.S.C. § 552, the Privacy Act of 1974, 5 U.S.C. § 
552a, and other applicable records access provisions. I have been employed by the Department 
in this capacity since March 2014, Prior to assuming this role, I served as the Deputy Director of 
IPS since April 2013. .As the acting IPS Director, I am authorized to classify and declassify 
national security information. I make the following statements based upon my personal 
knowledge, which in turn is based upon a personal review of the records in the case file | 
established for processing the subject request and upon information furnished to me in the course 
of my official duties. I am familiar with the efforts of Department personnel to process the 
subject requests, and I am in charge of coordinating the agency’s search and recovery efforts 


with respect to those requests. 
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2... The'core responsibilities of IPS include: (1) responding to records access requests 
made by the public (including under the FOIA, the Privacy Act, and the mandatory 
declassification review requirements of the Executive Order governing classified national 
security information), by Members of Congress, by.other government agencies, and those made 
pursuant to judicial process such as subpoenas, court orders, and discovery requests;’ (2) 
systematic review under the Executive Order; (3) records management; (4) privacy protection; 
(5) national security classification management and declassification review; (6) corporate records 
archives management; (7) research; (8) operation and management of the Department’s library; 
and (9) technology applications that support these activities. _ 

| 3. ‘The purpose of this declaration is (i) to describe to the Court the Department’s 
plan to review approximately 55,000 pages of e-mails and attachments to those e-mails (the 
55,000 pages”) that former Secretary of State Hillary Clinton provided to the Department in 
December 2014 and to post the releasable portions of the 55,000 pages on the Department’s 
website, and (ii to provide a date by which the Department proposes to complete that review and 


production. 


I, ADMINISTRATIVE PROCESSING OF PLAINTIFF’S REQUEST 


4. On November 14, 2014, plaintiff Jason Leopold submitted a FOIA request to the 
Department seeking every record prepared or maintained by the Department that mentions or 


refers to, or was prepared by, former Secretary of State Hillary Clinton, or anyone in the Office 


For example, in FY 2014, the Department received over 19,000 FOIA requests. Additionally, the 
Department has received nearly 14,000 new requests since October 2014 and is currently engaged in nearly 80 
FOIA litigation cases, many of which involve court-ordered document production schedules. The Department’s 
FOIA office is staffed with 63.5 fulltime employees to address these numerous FOIA requests and appeals, as well 
as FOIA litigation. 

2 my 
Leopold vy, U.S. Dep’t of State 
1:15-cv-000123-RC 

Hackett Declaration 
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of the Secretary, for her entire tenure in office (Jan. 21, 2009 — Feb. 1, 2013). Plaintiff also 

requested a fee waiver and expedited processing of the request. | 
aD. On November 14, 2014, IPS acknowledged receipt of Plaintiff's FOIA request, 

granted Plaintiff's request for a fee waiver, and denied his request for expedited processing. 

6. | On January 7, 2015, IPS reached out to Mr. Leopold in an effort to discuss the 
possibility of narrowing the scope of his broad, sweeping request, explaining that his request 

_would include hundreds of ouennde of documents. In addition, IPS explained that the retrieval, 
analysis, and review of only the Goats in the most relevant office would require years to 
complete, even if IPS could utilize the full resources of the FOIA office to focus solely on this 
case. | 

7. | On January 16, 2015, Mr. Leopold advised IPS that he would narrow the scope of 
his request “by excluding any secure that have already been made publicly available and basic 
media summaries.” 

8. On January 25, 2015, Mr. Leopold filed suit against the Department because it | 
had not responded to his request within the statutory time period. 

9. As detailed in the parties’ Joint Status febet Regarding Schedule (“Jt. Status 
Report”) filed on March 20, 2015, the Department engaged in further negotiations with Plaintiff 
regarding the scope of his request and noted that the Department was already in the process of 
reviewing for posting on the Department’s FOIA sebaite the releasable portion of the 55,000 
pages covering the period 2009-2013 that had been provided to the Department by former 

‘Secretary Clinton. The Department noted that this public release would substantially satisfy 


Plaintiff's request. At a Status Conference on April 8, 2015, the Court ordered the Department 
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to provide a proposed schedule of production for Secretary Clinton’s e-mails. See Order (April 
28, 2015), ECF No. 10. 


II]. DEPARTMENT’S PLAN FOR THE REVIEW OF FORMER.SECRETARY .- 
CLINTON’S E-MAIL RECORDS 


‘10. In December 2014, former Secretary Clinton provided to the Department paper 
copies of approximately 30,000 e-mails, comprising approximately 5 5,000 pages. Secretary 
Clinton provided these records in response to a letter sent by the Department of State to former 
Secretaries requesting that, if former Secretaries or their representatives were “aware or [were to] 
become aware in the future of a federal record, such as an email sent or received on a personal 
email account while serving as Secretary of State, that a copy of this record be made available to 
the Department. . ; if there is reason to believe that it may not otherwise be preserved in the 
Department’s recordkeeping system.” See Ex. 1 (Text of Letter to Former Secretaries of State 
Concerning the Federal Records Act of 1950). 

11. Given the considerable public interest in the 55,000 pages, the Department plans 
to review the collection for public release, consistent with the FOIA, and make the releasable 
portions of the 55,000 pages available to the public by posting them on the Department’s FOIA 
website. This will make the maximum number of records available to the public in the shortest 


amount of time, and will be considerably more efficient than reviewing the documents 


piecemeal, in response to multiple subject-specific FOIA requests.” The Department intends to 


? Although this case does not require a search of former Secretary Clinton’s emails for responsive records because 
plaintiff's FOIA request is for al/ of her records, any orders issued in other cases requiring the Department to 
conduct case-specific searches of former Secretary Clinton’s emails before the whole collection has been posted on 
the Department’s website could slow down the Department’s processing of the collection. Conducting such case- 
specific searches would take time and resources away from the broader review, the extent to which would depend on 
the breadth and complexity of those searches and FOIA requests. For that reason, the Department has taken the 
position that it would be more equitable to all requesters to avoid conducting case-specific searches until the entire 
collection has been processed, but has been ordered to do one discrete search in at least one case thus far. Freedom 
Watch v. NSA, Civil Action No. 1:12-cv-01088-CRC, Minute Order entered on May 4, 2015. See also { 16. 
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post the releasable portions of the collection at the conclusion of its review process, which will 
facilitate consistency in the application of FOIA exemptions and the public’s access to and 
understanding of the documents. | | | 

12. As “ined above: the Department received the 55,000 sees in paper form. The. 
documents were provided in twelve bankers’ boxes (approximately 24” x 15” x 10 Ww in size) 
with labels placed on the outside of the boxes that corresponded approximately to the timeframe 
of the documents within a given box. The Department initially performed tasks necessary to 
organize the records. This included foldering, boxing, and creating a box level inventory of the 
records. In consultation with the National Archives and Records Administration, the Department 
also conducted a page-by-page review ar the documents to identify, designate, mark, and 
inventory entirely personal correspondence, i.e., those documents that are not federal records, 
included within the 55,000 pages. 

13. Given the breadth and importance of the many foreign policy issues on which the 
_ Secretary of State and the Department work, the review of these materials will likely require 
consultation with a broad range of subject matter experts within the Department and other 
agencies, as well as potentially with foreign governments. These records are comprised of 
communications to or from the former Secretary of State, who was responsible for the overall 
direction and supervision of the full range of activities of the Department, which operates in 
approximately 285 locations around the globe. The Department is committed to processing the 
55,000 pages as expeditiously as possible, while taking into consideration the Department’s other 
legal obligations. | 

14. The Department has taken multiple steps to facilitate its review of the 55,000 
pages. It has developed an approach fe addressing the review, upgraded the capabilities of the 
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Department’s processing software, and dedicated staff. Currently, this project is staffed fulltime 
by a project manager and two case analysts, as well as nine FOIA reviewers who devote the 
entirety of their time at the State Department to this effort, plus other analysts and information 

' technology specialists whovarovide collateral assistance to this review in addition to their regular 
duties. The a managing this project has met daily since early April to implement and oversee 
this large undertaking. 

15. Each page of the 55,000 must be individually hand-processed in order to ensure 
that all jaiaiotiGli is being captured in the scanning process. The scanning process itself 
involves five steps that are time-consuming and labor-intensive. These are: (1) scanning 
(inserting barcode separator sheets between each document and its associated attachments and 
then scanning the documents, which includes converting them for optical character Heeapuition 
[“OCR”], and then inputting the resulting OCR-ed files into the system in batches based on 
search segments); (2) scanning éuislity control (the scanned material is checked to shine that 
each document is scanned Stoned and to flag documents that need to be re-scanned); (3) 
indexing (indexers ee each scanned document to manually input bibliographic coding, such 
as the “To,” “From,” “CC,” “BCC,” “Date Sent,” and “Subject” fields associated with that 
document into the system); (4) indexing quality control (a senior indexer etiews tie indexed. 
documents to ensure that the bibliographic coding has been properly input into the system); and, 
(5) duplicate detection resolution (the computer analyzes the indexed documents to identify 
possible duplicates between the document being ingested and those documents that already exist 
in the system). Any possible duplicates that cannot be resolved (identified as an exact duplicate, 
near duplicate, not a duplicate) by automated means are pushed forward for individual review for 
manual adjudication. This process was made even more esi iesed by the fact that some, but 


6 _ 
Leopold v. U.S. Dep't of State 
1:15-cv-000123-RC 
Hackett Declaration 


HRC-2548 


~ 


Case 1:15-cv-00123-RC Document 12-1 Filed 05/18/15 Page 7 of 13 


not all, of the paper records that the Department received were double-sided It took, the 
Department five weeks to perform the scanning process, which was completed recently i in May. 

, There will be ‘further work required to load these into a searchable database, which will be 

completed by mid- June. . - 

. 16. - Inthe weeks follwing th the Depariment’s rcpt of the e-mails from Secretary 

7 Clinton, the Department c conducted a separate manual review of a date-limited portion of the 
55,000 pages to locate any that were responsive to requests of the House Select Committee on 
Benghazi. As a result of that manual review, the Department located and produced to the House 
Select Committee 296 e-mails composed of approximately 850 pages. In light of the public 

| interest in those records and the fact that the Department already has identified, them within the 
larger collection, the Department has prioritized the FOIA review of those 296 e-mails. These 

- 296 e-mails were therefore scanned first, following the procedures described above. The review 

process for those e-mails included an initial review within the FOIA office, followed by | 

‘consultations and review by Department subject matter experts and other US. Government 

. agencies, as appropriate, for any documents containing information that originated with that 

agency and/or in which that agericy has a vested interest.? The Office of the Legal Adviser also 
reviewed these materials to ensure the proper application of FOIA exemptions. All material that 
can be released from the 296 e-iils wil be made publicly available on the Department’s FOIA 


he, 
website. 


> The Department reviews every FOIA request for U.S. Government interagency interests. In some instarices, as 
with some of the 296 e-mails discussed above, a document that originated with the Department of State may include 
information that originated with another U.S. Government agency. In accordance with Department FOIA 
regulations, that document would be referred to the applicable agency for a release recommendation or 
determination. The relevant agency then conveys its release recommendation or determination to the Department 

_ for response to the Fequester. See 22 C.F.R. § 171. 11K)3)- - . 
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17. The Department’s review of the Benghazi e-mails has highlighted several factors 
that it expects will affect the timing of the review of the remaining e-mails provided by 
Secretary Clinton. Like the Department of State itself, each of the U.S. Government agencies 
that need to review these documents deals with sensitive, emergent issues, which may require 
them to reallocate priorities and resources in response to changing events around the globe. 
Thus, the amount of time that other agencies may need to review these documents cannot be. 

. predicted with precision. The Under Secretary for Management has advised senior leadership. in 
_ other government entities (Central Intelligence Agency, Department of Defense, Department of 
Justice, Office of the Director of National Intelligence, National Security Council, and the White 
Hourse) of this review and has asked for their assistance. The Department has attempted to take 
into account these issues in developing its plan for the review and processing of the remaining e- 
mails provided by Secretary Clinton and in estimating the amount of time the review and 
processing will take. It is, however, possible that the time required for the interagency review 
process could impact the Department’s proposed review timeline. 

18. The Department’s review of the rest of the remaining records in the collection 
provided by Secretary Clinton is underway. As noted above, the Department’s objective is to 
make this information available to the public as quickly as possible. 

19. The Department has begun to implement the following plan to review the 
remaining material in the 55,000 pages. The collection has been separated into 300 segments of 
approximately 100 e-mails messages each. The Department plans to post on its. FOIA website all 
‘the releasable material in the collection after all of the e-mails have been reviewed using the 


following process, which involves ongoing, serial reviews of 10-segment batches: 
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Initial FOIA Office Review 


e Beginning in May, while scanning was still ongoing, the FOIA office began the 
review of the 55,000 pages. The FOIA office plans to review a batch (approximately 
1,000 e-mails) each week and apply initial proposed redactions consistent with our 
FOIA practice. | 


Consultation With Subject Matter Experts 


e The FOIA office then plans to send the batch to appropriate Department subject 
matter experts (“SMEs”) for consultation and review within one week. These SMEs 
are drawn from the ranks of the Department’s experienced foreign policy experts, 
who have continuing national security responsibilities. While SMEs are reviewing 
the first batch that the FOIA office has already reviewed, the FOIA office will begin 
reviewing the next batch.’ - 


e At the end of the week, the Department plans for the SMEs to return the batch that 
they reviewed, at which time the FOIA office would incorporate any appropriate 
review recommendations from the SMEs. The time required to do this will naturally 
vary, depending on the extent of the feedback from the SMEs, but the Department 
plans to adjust its resource allocation to ensure that this is accomplished as quickly as 
possible. 


Agency Consultations . . 
e The FOIA office will then refer any e-mails in segments implicating other agencies’ 


interests to those agencies for their review. 


e The agencies ‘will be asked to complete their review of each batch and return the 
materials to the FOIA office within one week. 


e Upon receipt of feedback from the relevant agencies, the FOIA office will incorporate 
any appropriate review recommendations. As with the SMEs, the time required to do 
this will naturally vary, depending on the extent of the feedback from the agencies. 


Legal Review 


e After the SME and agency review, the FOIA office plans to provide the batch to the 
Office of the Legal Adviser for a review. The Office of the Legal Adviser will be 
asked to complete its review of the batch within one week. ‘ 


e Upon receiving feedback from the Office of the Legal Adviser, the FOIA office will 
incorporate any appropriate review recommendations. 


‘ Thus, in the first-week, the FOIA office would review segments 1-10; in the second week, the FOIA office plans to" 
send segments 1-10 to SMEs and begin reviewing segments 11-20. 
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Final Review 


e Any divergent recommendations among reviewing entities will be resolved through 
‘discussions. 


e The Department plans to repeat the above process until all of the materials are 
reviewed. 


e After all of the materials have been reviewed, the Department plans to conduct a final 
review of the records to ensure that similar subject matter has been redacted in a 
fashion that is both internally consistent and legally appropriate. 


At the conclusion of this process, the Department will post all non-exempt material on the 
Department’s publicly-available FOIA website. | 

20. The Department’s plan, as outlined above, would result in its review being 
completed by the end of the year. To factor in the holidays, however, the Department would ask 
the Court to adopt a proposed completion date of January 15, 2016. As nied ahave the 
Depament understands the considerable public’s interest in these records and is endeavoring to 
complete the review and production of them as expeditiously as possible. The collection is, 
however, voluminous and, due to the breadth of topics, the nature of the communications, and 
the interests of several agencies, presents several challenges, aa desadbed above. Accordingly, 
the Department requests that the deadline for production of former Secretary Clinton’s e-mails to 
Plaintiff, via the Department’s production of the e-mails to the public on its FOIA website, be 
face 15, 2016. This date is premised on the Department’s good faith estimate of the time 
required to complete this involved, intensive process. Should unanticipated circumstances, or 
circumstances beyond the Department’s control, force any delay, the Departinent will, of course, 


keep the Court apprised of any such changes and seek modification of this deadline. 


e 
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eee 
I.-declare.under penalty of perjury:that the forgoing is true and correct to the.best of my 


knowledge; A 
day of May 2015, Washington, D.C. 


| UH 


John F..Hackett: 


_ Executed:this, [x 
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‘Gerlach, Alec — = ; 

from: ‘State: Department. Press:Office’ <usstatebpa@subscriptions. feg gOov>: 

‘Sent: Tuesday, March'10, 2015:5:28 PM’ 

To: Gerlach, Alec 

Subject: Letter Sent.by:the Department'to Representatives of Poiige Secretaries: of State 


-March, 10,2015: 
‘State:Department, Press Corps, 


‘Please :find below the text of the October'28, 2014 letter-sent by the Department to representatives.of former 
Secretaries of State, including Secretaries: Madeleine K. Albright, Colin Powell, Condoleezza Rice, and 
Hillary Clinton. The letter requested that copies of'any federal record. be made.available to the State 
Department for ‘preservation. 


Full text:of the letters follow: 
‘Dear.[Representative of former Secretary of State]: 


The:Department of 'State:has a longstanding and.continuing commitment to preserving the history of U.S. 
: diplomacy, established in authorities under the Federal Records.Act of 1950. Lam. writing to you, the 
‘representative of Seeretaty of State: {(NAME], as. well as to rcprésentatives-of other former Secrétaries 
(principals), to: Tequest your ‘assistance:in further meeting this requirement. 


The Federal Records,Act of 1950, as,amended, 44 U.S.C..chapters. 29, 31.and.33,-secks.to ensure the 
preservation of an authoritative:tecord of official correspondence, communications, and-documentation: Last 
year, in Bulletin 2013-03, the National. Archives.and Records Administration (NARA) clarified records 
management responsibilities. regarding the use: of personal:email.accounts for official: government.-business. 
NARA recommended that agencies.refer:to its. guidance when advising incoming, and departing agency 
employées about thei records: ‘management responsibilities. This bulletin was-followed by: additional NARA 
guidance:on managing. email:issued.on September 15,2014. See enclosed: 


pict 


the NARA audaics dee. that:service. Nel we Se the NARA. padance to your attention in 
order to ensure that the’ Department's records aré as complete as possible: Accordingly, we.ask that should 
your principal: or his:or her-authorized. representative be:awareor become aware in the. future of a:federal. 
record, such as'an email serit or réceived.on a.personal email account while:serving as Secretary. of State, that 
a.copy ‘of this record be:made available to the Department: In this regard, please note.that-diverse _ 
Department records.are:subject to’ various disposition schedules, with most Secretary of'State'records 
retained-permanently. We.ask that.a record be provided to the: Department if there is reason to believe that it: 
may not otherwise. be preserved i in:the: Department's recordkeeping system. 


The Department:is:willing:to provide assistance to you:in this effort. In the meantime, should. -you have any. 
questions regarding this request, please do not hesitate to contact [Name of Agency Records: Officer], 
A/GIS/IPS/RA, Agency’ Records Officer, at (XXX). XXX*XXXX]. 


We greatly appreciate ‘your consideration of-and assistance with this matter. 
‘Hackett. Declaration 
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Sincerely, 


‘Patrick F. Kennedy 
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Aub TNPURUATION CONTAINED 
HESEIN [5 UNCLASS ET 
a SS... 


UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


JASON LEOPOLD, 
Plaintiff, 

Vv. Civil Action No. 15-cv-123 (RC) 

US. DEPARTMENT OF STATE, . | | 


Defendant. 


DEFENDANT’S STATUS REPORT REGARDING 
RELEASE OF RECORDS ON JULY 31, 2015 


Defendant U.S. Department of State (“the Department”), in response to the Court’s Order 

of May 27, 2015 (ECF No. 1 7) (“Scheduling Order”), respectfully submits this status report 
regarding its release of the non-exempt portions of records subject to FOIA contained in the 
emails provided to the Department by former Secretary of State Clinton: 

7 - In December 2014, the Department received 53,988 pages of documents 
consisting of emails and attachments to annails from former Secretary Clinton. In consultation 
with the National Archives and Records Administration, the Department identified 
approximately 1,533! pages of those documents as entirely personal correspondence, that is, — 
documents that are not federal records and thus that are not subject to the FOIA, leaving _a total 
of appiouiiaisly 52,455* pages remaining to be reviewed and released. 

2... The Court ordered the Department to aspire to produce certain percentages of 

_ cumulative havea of former Secretary Clinton’s emails each month, to file a status report within a 


' This number has a margin of error of about plus or minus four pages. That difference does not affect the 
percentage provided below. 


? This number has the same plus-or-minus-four-page margin of error as the number of pages of entirely personal 
correspondence. Again, this has no effect on the percentage provided below. 
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week of each monthly production reporting on the number of pages produced, and in the event 
the Department misses a production goal, to explain in the report how it intends to catch up. The 
production goal for July 31, 2015 is 15% of the total number of pages to be reviewed. 
Scheduling Order at 1-2. | | 

3. As previously reported to the Court, the Department had posted 3,942 pages, or 
7.5% of the total number of pages to be reviewed, as of June 30, 2015, slightly surpassing its 7% 
goal for June. See Def.’s Status Report | 5 (ECF No. 20). 

4. On July 31, 2015, the Department posted on its FOIA web site 2,206 additional - 
pages of documents from the collection provided by former Secretary Clinton. These documents 
may be viewed at the following URL: 

. http://foia.state.gov/Search/Results.aspx?collection=Clinton_ Email July_Release 

5. Thus, as of July 31, 2015, the Department has posted a total of 6,148 pages, or 
11.7% of the total number of pages to be reviewed. This is 1,721 pages, or 3.3 percentage 
points, short of the goal set forth in the Scheduling Order. The attached declaration of John F. 
~ Hackett (“Hackett Declaration”), Director of the Department’s Office of Information Programs 
and Services, explains in detail how the Department plans to’ make up half of the deficit in its 
release on August 31, 2015, and half in its release on September 30. Hackett Decl. { 7. 

| 6. As the declaration explains, the Department, in response to recommendations 
from the Inspectors General (“IG”) for the Department and for the Intelligence Community 
(“IC”), made arrangements for the IC to provide reviewers to assist the Department in 
identifying potential IC equities in its review of the emails. Hackett Decl. 44. The IC reviewers 


began working in a Department facility on July 15, 2015 to screen documents to identify their 
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agencies’ equities; ieuimnents with such equities must be sent to the relevant agency for 
consultation before they can be processed for release. Id. 4 5.. The IC reviewers had only eight 
business days, until July 24, to screen documents for the July 31 release. Jd. As part of its 
implementation of the IGs’ recommendations, and . order to avoid any potential issues 
involving IC equities in the July 31 release, the Department only released emails that had been 
screened by the IC reviewers and identified as not having agency equities. Jd. ] 6. Asa result, 
the Department was unable meet the Court’s goal for the month of July. 

7. Mr. Hackett anticipates that the IC ayiGwers will be able to screen documents at a 

. pace sufficient to allow the Department to make up the deficit during the August and Stichibes a 

releases? Hackett Decl. 47. Mr. Hackett believes that the IC reviewers will be able screen 
documents at this rate because they are now fully integrated into the process and will become . 
tncreasindly familiar with the documents. Id. And Mr. Hackett has been advised that, if : 
necessary, the IC reviewers will devote additional hours to the eile process. Id. ¥ 8. 
Accordingly, the Department believes it will be able to catch up with the schedule set forth in the 


Scheduling Order by September 30, 2015. 


3 The Hackett Declaration also explains that the number of emails that have cleared the other steps in the 
Department’s review process meets or exceeds the milestones in the original plan developed to comply with the 
Scheduling Order. Hackett Decl. ¥ 8. 
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Date: August 7, 2015 Respectfully submitted, 


BENJAMIN C. MIZER 
Principal Deputy Assistant Attorney General 


MARCIA BERMAN 
Assistant Branch Director 


/s/ Robert J. Prince 

ROBERT J. PRINCE (D.C. Bar No. 975545) 
United States Department of Justice 

Civil Division, Federal Programs Branch 

20 Massachusetts Ave., N.W. 

Washington, DC 20530 

Tel: (202) 305-3654 
obert.prince@usdoj.gov 


Counsel for Defendant 
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ALL THEUORVATICN JOU TAINED 
BEREIN [5 UPC Leésslel 
DATE 12-05-2016 BY J 7eJleTs0 NalcG 


UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


JASON LEOPOLD, ) 
Plaintiff, : 
v. No. 1:15-cv-000123-RC 
U.S. DEPARTMENT OF STATE, | | 
Defendant. 


a ee SE) 
SECOND DECLARATION OF JOHN F. HACKETT » 

Pursuant to 28 U.S.C. § 1746, I, John F. Hackett, declare and state as ila: 
. 1. Iam the Director of the Office of Information Programs and Services (“IPS”) of 
the United States Department of State (the “Department”). In this capacity, I am the Department 
official immediately responsible for responding to requests for records under the Freedom of 
Information Act (the “FOIA”), 5 U.S.C. § 552, the Privacy Act of 1974, 5 U.S.C. § 552a, and 
other applicable records access provisions. I have been employed by the Department in this 
capacity since June 2015. Prior to assuming this role, I served as the Acting Director of IPS 
since March 2014, and previous to that, I served as the Deputy Director of IPS since April 2013. 
As the IPS Director, I am authorized to classify and declassify national security information. I 
make the following statements based upon my personal knowledge, which in _ is based upon 
information furnished to me in the mee of my official duties. I am familiar with the agency’s 
efforts to process for release the subject documents and with the efforts of Department personnel 


undertaken to do so. 
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2. . In the Court’s order pertaining to the production of iseards in the approximately 
55,000 eae of emails provided to the Department of State by former Secretary of State Clinton 
(“the emails”), the Court ordered the Department to “aspire to abide by [a] production schedule” 
with a “Cumulative Pages Completed” target of 15% by July 31, 2015. (ECF No. 17) 
(“Scheduling Order”). As of July ai, 2015, the Department has produced 11.7% of the sates of 
emails ail is 1,721 pages behind the Court’s goal. The purpose of this declaration is, in 
accordance with the Court’s order, for the Department to “explain in detail . . . how it intends to 
catch up with the schedule by adding resources or otherwise.” Id. at 2. 

3. ° In my previous declaration of May 18, 2015 (“Previous Declaration”) (ECF No. 
12-1), I explained that the Department would conduct an ongoing, serial review of the emails for 
public release, consistent with the FOIA, involving the following steps: (1) initial FOIA office ‘ 
review, (2) consultation with abies matter experts within the Department; (3) consultations 
with other agencies who have Souiies in the documents (only if necessary); (4) review by the ° 
Office of Legal Adviser; (5) final review to resolve recommendations and process documents for 

| release, Previous Declaration | 19. | 


u 


4. The Department recently added another step.in the review process, at the 
recommendation of the Inspectors General for the Department and the Intelligence Community 
(“IC”),! These Inspectors General raised concerns about the Department’s evaluation of other 
\ 
' The Office of the Inspector General of the Intelligence Community was established 
‘ pursuant to Section 405 of the Intelligence Authorization Act of Fiscal Year 2010, which 
amended the National Security Act of 1947. (Pub. L. No: 111-259, 124 Stat. 2709 (Oct. 7, 
2010)). “The IC IG is responsible for conducting IC-wide audits, investigations, inspections, and 
_ reviews that identify and address systemic risks, vulnerabilities, and deficiencies that cut across 
IC agency missions, in order to positively impact IC-wide economies and efficiencies.” 


‘http://www.dni.gov/index.php/about/organization/office-of-the-intelligence-community- 
: . 2 ts 
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agencies’ eauities and recommended that the Department’s FOIA Office seek staff support from - 
IC FOIA offices to assist in identifying IC equities. In response to this Jecoinmenitiation, the 
Department made arrangements for the IC to provide reviewers to assist the Department in 
identifying potential IC equities in its review of the saat 

5. The IC reviewers, ceonesenting five agencies, began working in a Department 
facility on July 15, 2015 to perform preliminary screening of emails to identify their agencies’ 
equities. The IC reviewers had only eight business days, until July 24, to screen documents for 
the July 31 release.” . At least part of that time was occupied by administrative and orientation 
tasks that naturally arise when a worker from one agency is assigned jeepers duty at aAorheh | 

6. When an IC reviewer identifies a agency equity in an email, that email is sent to 
_ the relevant agency for consultation. As part of its implementation of the IGs’ recommendations, 
and in order to avoid any potential issues involving IC equities in the July 31 release, the 
Depaeitient only released emails that had been screened by the IC reviewers and identified as not 
having agency equities. This screening process could only be completed for enough documents 
to allow the Department to post 2,206 additional pages on July 31 : | 

7. As noted above, the IC reviewers were added toward the end of the review 


process for the July 31 release. But they are now fully integrated into the process, and as they 


inspector-general-who-we-are (last visited Aug. 5, 2015). 


2 The July 24 cutoff date was set to allow IPS sufficient time to perform a final review of 
the documents and to process them for release, as well as to upload the documents to the 
Department’s FOIA web site. Documents screened since the cutoff date are set for inclusion in 
the August 31 release. 


3 Almost all the emails being reviewed for release were made available to the IC 
reviewers for screening. Some emails, such as those dealing solely with Department personnel 
matters, do not need to be screened by the IC reviewers. 
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gain familiarity with the documents, I expect the screening of emails for IC equities to proceed 
~ more quickly. Accordingly, the Départment plans to make up the 1,721 pages it is behind over — 
the course of the next two submissions, such that it is back on track by Scronber 30, 2015. 
More specifically, the Department plans to release 6,106 or more pages on August 31, bringing 
the cumulative progress to at least 23.4% (just shy of the Court’s goal of 25% for August 31), 
and 7,156 on September 30, bringing the cumulative progress to 37% (the goal set by the Court 
for September 30). | 

8. A schedule has been established and shared with the IC Reviewers that will allow 
the deficit to be made up over the next two months. I have bees advised that, if necessary, the IC 
feviewers Will devote additional hours to the review process. My belief that the Department can 
get back on track by the end of September is fitiher infornied by the fact that the number of 
emails that have cleared the other steps in the Department’s review process meets or exceeds the 


milestones in the original plan developed to comply with the Scheduling Order. 
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aoe 


Ideclare under penalty of perjury: that the foregoing is true and correct to the best of my 
knowledge. 


Executed this: day of August 2015, Washington, D.C. 


John F. Hackett. 


Leopold v.'U-S. Dep't of State 
1:15-cv-000123-RC 
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United States Department of State 


Washington, D.C. 20520 


August 13, 2015 


MEMORANDUM 

TO: DS/CY/CI hp peas 
THROUGH: DS/ICI/CI 

FROM: DS/ICY/CI 

SUBJECT: Preliminary Inquiry Opening Memorandum fof bib per DOS 


In accordance with 12 FAM 262.3-1(C) and based upon the information set forth below, 
authorization is requested to open a preliminary inquiry. 


#)_On 08/11/2015, DS/ICI/CI received arecord request} fs epee 
1G Cone Peas SweweieerEt he information was requested to satisfy a Section c) that the FBI 


bl per DOS 
bil per DOS 
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PT401 No FEAR Act Training 
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STEP: 00 
AGN: ST 00 
WGI DUE: 
FEGLI; 


MSI/OSI 


DATE 
05/05/2009 


CLASSIFIED INFORMATION NONDISCLOSURE AGREEMENT 
AN AGREEMENT BETWEEN 


Hillary Rodham Clinton AND THE UNITED STATES 


(Name of Individual — Printed or typed) 


1. intending to be legally bound, | hereby accept the obligations contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
including oral communications, that is classified under the standards of Executive Order 12958, or under any other Executive order or 
statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2, 1.3 and 
1.4(e) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security. |.understand and accept that by being granted access to classified information, » special confidence and 
trust shall be placed in me by the United States Government. - - ~ 


2. thereby acknowledge that | have received a security indoctrination concerning the nature and protection of classified information, 
including the procedures to be followed in ascertaining whether other persons to whom | contemplate disclosing this information have 
been approved for access to it, and that | understand these procedures. 


3. {have been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information by me 
could cause damage or irreparable injury to the United States or could be used to advantage by.a foreign nation. | hereby agree that | 
wiil never divulge classified information to anyone unless: (a) | have officially verified that the recipient has been properly authorized by 
the United States Government to receive it: or (b) | have been given prior written notice of authorization from the United States 
Govemment Department or Agency (hereinafter Department or Agency) responsible for the classification of information or tast granting 
me a security clearance that such disclosure is permitted. 1 understand that if | am uncertain about the classification status of 
information, | am required to confirm from an authorized official that the information is unclassified before | may disclose it, except to a 
person as provided in (a) or (b), above. | further understand that { am obligated to comply with laws and regulations that prohibit the 
unauthorized disclosure of classified information. 


4. Ihave been advised that any breach of this Agreement may result in the termination of any security clearances { hold; removal from 
any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security clearance or clearances. In addition, | have been advised that any unauthorized 
disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the 
provisions of Sections 641, 793, 794, 798, “952 and 1924, Title 78, United States Code, ‘the provisions of Section 783(b), Title 50, 

United States code, and the provisions of the intelligence Identities Protection Act of 1982. | recognize that nothing in the Agreement 
constitutes a waiver by the United States of the right to prosecute me for any statutory violation. 


5. | hereby assign to the United States Goverment all royalties, remunerations, and emoluments that have resulted, will result or may 
result from any disclosure, publication or revelation of classified information not consistent with the terms of this Agreement. 


6. | understand that the United States Government may seek any remedy available to it to enforce this Agreement including, but not 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 


7. lunderstand that all classified information to which { have access or may obtain access by signing this Agreement is now and will 
remain the property of, or under the céntrol of the United States Government unless and until otherwise determined by an authorized 
- Official or final ruling of a court of law. | agree that | shall return all classified materials which have, or may come into my possession or 
for which f.am responsible because of such access: (a) upon demand by an authorized representative of the United States 
Govemment; (b) upon the conclusion of my employment or other relationship with the Department or Agency that last granted me a 
security clearance or that provided me access to classified information; or (c) upon the conclusion of my employment or other 
relationship that requires access to classified information. If | do not return such materials upon request, | understand that this may be 
a violation of Sections 793 and/or 1924, Titie 18, United States Code, a United States criminal taw. 


8. Unless and until | am released in writing by an authorized representative of the United States Government, | understand that all 
conditions and obligations imposed upon me by this Agreement apply during the time | am granted access to classified information, 
and at all times thereafter. 


9. Each provision of this Agreement is severable. If a court shauild-f find. any Provision of this Agreement to be unenforceable, ail other 
provisions of this Agreement shall remain in full force and effect. 


(Continue on reyersé) = « 
NSN 7540-01-280-5499 STANDARD FORM 312 (Rev. 1-00) 
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10. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or 
liabilities created by Executive Order 12958, Section 7211 of Title 5, United States code (governing disclosures to Congress); Section 
1034 of Title 10, United States code, as amended by the Military Whistleblower Protection Act (governing disclosure to.Corgress by 
members of the military); Section 2302(b) (8) of Title 5, United States Code, as amended by the Whistleblower Protectidn Act 
(governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 
1982 (50 U.S.C. 421 et seq.) (governing disclosures that expose confidential Government agents), and the statutes which protect 
against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, 952 and 1924 of Title 18, United 
State Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. ; 


11. | have read this Agreement carefully and my questions, if any, have been answered. | acknowledge that the briefing officer has 
made available to me the Executive Order and statutes referenced in this agreement and its implementing regulation (32 CFR Section 
2003.20) so that | may read them at this time, if { so choose. ~ oe . 


ORGANIZATION (IF CONTRACTOR, LICENSEE, GRANTEE OR AGENT, PROVIDE: NAME, ADDRESS, AND IF APPLICABLE, FEDERAL SUPPLY CODE NUMBER) 
(Type or print) 


SIGNATURE SOCIAL SECURITY NUMBER 


(See Notice below) 


b6 per DOS 


Department of State 
2201 C Street NW 
Washington, DC 20520 


WITNESS . ACCEPTANCE 


THE EXECUTION OF THIS AGREEMENT WAS WITNESSED | THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 

BY THE UNDERSIGNED. BEHALF OF THE UNITED STATES.GOVERNMENT. 

SIGNATUR SIGNATURE DATE (mm-dd-yyyy) 
NAME AND ADDRESS (Type or print) NAME AND ADDRESS (Type or print) BepSe Pee 


b7C per DOS 


Department of State 
2201 C Street NW 
Washington, DC 20520 


SECURITY DEBRIEFING ACKNOWLEDGMENT 


‘1 reaffirm that the provisions of the espionage laws, other federal criminal laws and executive orders applicable to the safeguarding of classified 
information have been made available to me; that | have returned all classified information in my Sronnt A that | will not communicate or transmit 
Classified information to any unauthorized person or organization; that | will promptly repart to the Federal Bureau of investigation any attempt by an 
unauthorized person to solicit classified information, and that | (have) (have not) (strike out inappropriate word or words) received a security debriefing. 


SIGNATURE OF EMPLOYEE DATE (mm-dd-yyyy) 


NAME OF WITNESS (Type or print) SIGNATURE OF WITNESS 


NOTICE: The Privacy Act, 5 U.S.C. 552a, requires that federal agencies inform individuals, at the time information is solicited from them, whether the 
disclosure is mandatory or voluntary, by what authority such information is solicited, and what uses will be made of the information. You are hereby 
advised that authority for soliciting your Social Security Number (SSN) is Executive Order 9397. Your SSN will be used to identify you precisely when it 
is necessary to 1} certify that you have access to the information indicated above or 2) determine that your access to the Information indicated has 
terminated. Although disclosure of your SSN is not mandatory, your failure to do so may impede the processing of such certifications or determinations, 
or possibly result in the denial of your being granted access to classified information. ; 


*NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. 
STANDARD FORM 312 BACK (Rev. 1-00) 
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8 b7C per FBI 
From: Hession, Leo J (OIG) <HessionLJ @state.gov> 
Sent: Thursday, June 25, 2015 12:33 PM 
To: . OIG 
7 (OIG); 
Subject: FW: Congressional Letter and Documentation 
Attachments: 2015.06.23 - Chairmen Corker Johnson Letter to Sec Kerry - FOIA release ....pdf; Outside 


Agency POCs; HRC email review; FW: Update on 296; RE: Assume.....; L Review of Former 
Secretary Clinton's Emails ; FW: At my desk; Re: Update; RE: Status of Review ; Re: Status 
of Review; Fw: Status of Review; Fw: Status of Review; RE: Status of Review; today's 
status; RE: Bureau Security Officers (BSOs); Re: Follow Up to Yesterday's Meeting 


Team — | am forwarding to you an email that | received today from[ | discussed this 
wit - . . bE. 
‘b7C 
| have reviewed the attachments as well as the email. Elements of this will be of interest to all 
and especially tol___| and any others working on the issue of classification of the emails | 
is currently in process of reviewing a large number of documents previously provided 
by and some of those documents may relate to this. 


S | have not entered this packet into SharePoint. | assume that will be done by the team leads 
on this issue, for ease of retrieval under their names. 


Thanks. Leo 


Leo J. Hession Jr. 

Senior Inspector 

Office of inspections, Office of The incoeetar General (OIG/ISP) 
U.S. Department of State 

703-284-2765 


sa 
This email is UNCLASSIFIED. 


From{___ | b6 
Sent: Thursday, June 25, 2015 11:12 AM : b7Cc 
To: Hession, Leo J] (OIG) 

Subject: Congressional Letter and Documentation 


Leo, 


1 --HRC-2650 


A serious matter was brought to my attention yesterday and it weighing heavy on our minds today. Attached is 
a letter from Chairman Corker and Chairman Johnson about.an allegation that classified information was 

& released to the public on May 22 during the release of the 296 emails from Secretary Clinton. This letter has 
already caused concern in our organization. I want to share with you what has happened, at least from my 
perspective, so that is known that our FOIA Office did not have the final authority or say as to how the 296 
were released. 


lam going to propose to my leadership that we postpone the release of any more Secretary Clinton emails until 
we have worked with the IC and others on a path ahead. This may conflict with the court order to release 
emails on June 30" but I think it is the responsible thing to do to prevent any issues or concerns related to 


national security. 


Back to the 296 emails. The “L” review in this review process for the 296, which was the final step in this new 
review process, involved] who works in the Bureau of Legislative Affairs (H); he is an attorney 
who I believe was hired on a special appointment and works in H but also has ties directly to the 7" floor (up to 
the Secretary’s Chief of Staff). He works closely with another attorney who I also heard was hired on a special 
appointment who is also in H and has access to senior principals in the - 
Department. 
Clinton; we received the 54k pages of emails from Williams and Connolly. I’ve also been told tha 
and was possibly involved with what was going on at the IRS and Lois Lerner. 

arrived less than a year ago and nave pen uniquely interested in anything related to Secretary Clinton Pe 


b7c 
since their arrival. 


> 


See email “L Review of Former Secretary Clinton’s Emails” for the tasking to “L” (which included [from 
H) for the 296 emails. After fighting to ask why H is involved in FOIA releases, we were under pressure to go 
along with what we were told to do (i.e. let H participate in the L review) which we did. 


I have shared examples with you about how the FOIA process for the Clinton process de rocess deviates from our regular 
practice. I want to make sure that I was clear in explaining how H (at oo ace and =— 
played a major role in how B(1)s turned into B(5)s for the 296. 
sae 
Additionally] _ repeatedly insisted on more than one occasion (to me) that the 296 emails were 
unclassified (not containing any classified information), at one point, I believe that he even told me that they put 
the 296 on OpenNet for their review, even though we suggested that they treat the collection as classified 
information. [had advocated waiting for the FOIA review to be completed before making any such assertions 
about classification. I don’t know what representations were made to the Congress about the 296 emails (or 
how they were identified in the collection of the 54k); I also don’t know if the Congress is storing the 296 as ig 


classified (or safeguarding as such in general). bic 


On one ccesionf a me one to explain how nothing in the 296 is classified so 
that FOIA review should be easy. They also suggested that the FOIA office did not need to vet the 296 with 
other agencies because they said that they already did it for the Congressional document production to the 
Select Committee. With support from my leadership, I insisted that we consult our regular FOIA POCs for this 
effort. While I was able to corroborate that i none with White House Counsel, 
someone from a part of the Department of Defense, and Department of Justice, we were never able to confirm 

~ their claim that that vetted the 296 with the CIA, which they claimed to do. I asked repeatedly for their POCs at 
the CIA but received nothing; I received the White House Counsel, DoD, and DOJ POCs almost 
immediately. We were then asked for our FOIA POCs which were likely provided to L and H (see attached 
email Outside Agency POCs). 


2 | HRC-2651 


On more than one occasion, I’ve counseled __ bout security practices here in the Department; I only didso 6 
when I thought that something he wanted to do would affect GIS (or was wrong with regard to federal or Pee 
Department policy or law). For example, he was bringing people from other agencies to review Benghazi 

material in SA-2. We stored a lot of that material here for the reviews related to Congressional productions to 

HOGER and then the Select Committee. I asked him to make sure that he was passing clearances along from 

other agencies because SA-2 is an open storage facility and just because someone works for an agency does not 
necessarily mean that s/he is cleared. See attached email (RE: Bureau Security Officers) for an example. 


As you know, there was one B1 redaction in the 296 emails. Tt was based on feedback from the FBI. Several 
people from outside of the FOIA office (but within the Department) tried to get the FBI to change their B1 

redaction to something else (like B5). If you wanted-to ask the FBI about what happened, our FOIA POC at 
rali{ | : 


The moment thai ound out about the B1 redactions (i.e. classified material — four from NEA and one 

from the FBI) he told me that he would need to talk to the DAS in NEA who made the decision to classify 
information and asked for his name, which I provided. The NEA DAS if It is my * bE 
understanding that L (and possibly others) went to NEA to brief them on FOIA and how other redactions like Be 
B5 could be used; it appears that the intention of such a briefing was to get NEA to agree to change their B1 
redactions to something else (like B){ our new acting Assistant Legal Adviser, was involved in 

this effort. 


As you can imagine, our staff who knows about this letter from Congress is concerned; this concern will only 
spread when word gets out about the letter. I want to make sure that you have the facts and some of the 
background (as I understand.it) in this case because there are now serious allegations being made. 


@ I hope that this helps. 

Best 

-_ : 
b7C 


Office of Global Information Services (A/GIS} 
U.S. Department of State’ 
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| | b3 per ODNI 
@ From: 


Sent: Monday, June 29, 2015 12:27 PM , 
To: | 


Subject: FW:-SBU: Fw: Concerns about the HRC Review... 
As discussed. 


From: Chuck Mccullough 


Sent: Monday, June 29, 2015 11:16 AM 


Subject: FW: $8th Fw: Concerns about the HRC Review... 


cI 


Need you plugged in on this: Need to coordinate w/ State's WB person. 
Chuck 


|. Charles McCullough, III 


Intelligence Community Inspector General . ; 
: b3 per ODNI 


From: Linick, Steve A (OIG) [mailto:linicksa@state.gov] 
Sent: Monday, June 29, 2015 6:13 AM 

To: Chuck Mccullough 

Subject: Fw: SB: Fw: Concerns about the HRC Review... 


See below 


From{_ (oi) [J os 
Date: June 28, 2015 at 9:40:17 PM EDT | Bie 


To: (oisf nick, Steve A (OIG) <linicksa@state.gov>[.______—_J OIG) 


Subject: Fw: SBU: Fw: Concerns about the HRC Review... r 
b3 per ODNI 


Fyi, see bottom email of ___—_—_ assessment over the weekend. | will draft an MA to go out prior to Tuesday's 
release and will circulate in the am. : 


From: , PE 
Sent: Sunday, June 28, 2015 09:30 PM 1 eee 


i a a 
Subject: Fw: SBU: Fw: Concerns about the HRC Review... 


1 . FRC-2653 


- Sent: Sunday, June 28, 2015 05:05 PM Eastern Standard Time 


@ To: Barr, Joyce A; Grafeld, Margaret P 

Subject: Re: SBU: Fw: Concerns about the HRC Review... we 
b7C 
For your dele A | just spoke about Tuesday's release. He was in the office and raised the following 
issue with me. The White House is asking the Department to potentially remove a few emails before we publish them on 
Tuesday. | asked him to let me know which ones. | did not raisd_—_|email as | know that one of you are going to raise 
it with M. , 


Based on my conversation with __]there appears to still be an expectation that we will release emails on Tuesday. | 
agree with Peggy that we should get confirmation (preferably in writing) about releasing on Tuesday. 


From: Barr, Joyce A 

Sent: Sunday, June 28, 2015 04:57 PM Eastern Standard Time 
To: Grafeld, Margaret P 

Cc 

Subject: Re: SBte Fw: Concerns about the HRC Review... 


b6 
b7C 


Ok got stuck behind an accident at gas station now. Will come back when | get home in 20 minutes. 


Sent from my BlackBerry 10 smartphone. 
From: Grafeld, Margaret P 
Sent: Sunday, June 28, 2015 16:42 


S To: Barr, Joyce A . | 
b7C 


Subject: Re: SBt Fw: Concerns about the HRC Review... 


I've been thinking about the best approach to K2 (or to PK himself). For a number of. reasons, | think it is better coming 
from you, if you don't mind. | believd —_ bhared some related background with you Friday at the 1x1. Happy to talk, if 
you would like. 


; BTW, thanks to a Herculean effort of a number of people working long hours yesterday (doing time consuming and labor 
intensive quality control), we'll be ready to post/release for sure early Tuesday. That said, I'd really like someone (M?) 
to actually give us the word to do it - and when. Additionally, this effort provides some insight vis a vis Congressional 
Document Production - that it is not an easy, fully automated process when done right. 

; 
From: Barr, Joyce A 
Sent: Sunday, June 28, 2015 2:32 PM 


To: Grafeld, Margaret P 
: . b7Cc 
Subject: Re: SBtk Fw: Concerns about the HRC Review... 


| am not an expert on this stuff but this seems to be a pretty in-depth analysis of issues that warrant a closer look. | 

definitely think it needs to be raised with M. Let M pass it to L. | would forward[ —_]e-mail to K-2 without his b6 
S comment at the end, he is entitled to his opinion but the blame game doesn't always follow facts. I'm heading out but b7c 

let me know if you want me to forward this or call K-2. I'll keep checking. 
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Sent from my BlackBerry 10 smartphone. 
From: Grafeld, Margaret P 

Sent: Sunday, June 28, 2015 11:46 

To: Barr, Joyce A 


ccf bs 


Subject: SBt Fw: Concerns about the HRC Review... PIC 


S ‘gc p 4 } if | 


Joyce, 


lam forwardinf____ message for your informational awareness, as he requested. | have not reviewed the documents 6 


he has, so | cannot affirm his concerns - nor would | presume to do so. Indeed, the multi-level review process for this Bis 
collection was established to ensure that a wide variety of SME's (including those in bureaus and offices with the most 
contemporary knowledge of current sensitivities, not to mention referral to other agencies for review of their respective 
equities). That said, | would appreciate your consideration of raising this with M and L - or whether we should proceed 

- with Tuesday's scheduled court-ordered release/posting pased on review by Department experts and L's final review. 
With thanks in advance for your guidance regarding how we proceed. oa . 
Peggy . . 
From[__ 
Sent: Saturday, June 27, 2015 2:46 PM 
To: Grafeld, MargaretP 
Ce: b6 

b7C 


’ Subject: Concerns about the HRC Review... 


Peggy, 


Sasi ema: cheenaremaeteennenentn eemeren atemeemne eeu caeeeeaeteee Oommen 


. \ 
A quick note from the office ona rainy Saturday with some concerns about the HRC review. | ask that you pass this note 
onto Joyce. : 

see ea Toes SSN as een 
At the request of the State Department OIG, we have beeni providing access to the HRC collection to an inspector from 
the IC’s OIG. This person was here late last night, and is here again today. We are providing him documents to review 
based on searches of Freedom2; he is providing us the search terms. So far this work has not interfered with our 


production schedule. 


While working with this inspector, | have personally reviewed hundreds of documents in the HRC collection. | can now 
say, without reservation, that there are literally hundreds of classified emails in this collection; maybe more. For 
example, there are comments by Department staff in emails relating to the Wikileaks unauthorized disclosures; many of 
the emails relating to this actually confirm the information in the disclosures. This material is the subject of FOIA 
litigation, and the emails will now have to be found, reviewed and upgraded. Under the EO 13526, it would be in our 
right to classify the entire HRC collection at the Secret level because of the “mosaic effect.” While there may be IC 
equities in the collection, | am very concerned about the inadvertent release of State Department’s equities when this | 
collection is released in its entirety -- the Rotsute damage to the foreign relations of the United States could be 
significant. 


I think the State Department's management is unaware of how unique this review and release project is. This project is 
one of a kind---of the prior nine Secretaries of State, NONE have made their personal papers available to the public so 
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"close to their departure from office. There is probably a reason for this—the information is too sensitive. In addition, 
none of the previous nine Secretaries have had their papers exposed to FOIA requests; and only one, Warren 
Christopher, released his papers without restrictions. The opening of his collection in 2014 was done 17 years after the 
papers were first donated to the Hoover Institution. Of the last nine Secretaries, either they have not made their papers 
available; or they have closed them to the public; or they have placed restrictions on their access. In the case of 
Alexander Haig and Edmund Muskie, the government had to remove hundreds of boxes of papers that contain classified 
materials. 


- Regarding the current review, given the content and scope of the collection, and the speed in which the review is being 
conducted, | am concerned that possible classified material will be posted in Tuesday’s release. While the Department | 
cannot be held responsible for the decision by the Court to release this material so soon, we do have the opportunity to 
push back on the schedule in order to make a proper review. In my opinion, more material needs to be referred to other 
agencies for consultation; and more material needs to be upgraded. Since we are not being given enough time by 
Department management to do this, the A Bureau and IPS, cannot be held responsible for the overall damage to U.S. 
foreign policy that may occur with this release. 


= 


b6 
b7C 


Office of Information Programs and Services (IPS) Bureau of Administration Department of stad 
Washington, DC 20520 
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UNDER SECRETARY OF STATE 
FOR MANAGEMENT 
WASHINGTON 


SEP 1 4 2015 


Dear Mr. Comey: 


We understand that the Federal Bureau of Investigation (FBI) has obtained the private 
server used by former Secretary Clinton to operate her personal email account along with one or 
more related thumb drives. While we do not want to interfere with the FBI’s review, the 
Department of State has an interest in preserving its federal records and, therefore, requests the 
FBI’s assistance. 


On May 22, 2015,.the Department requested from former Secretary Clinton’s attorney, 
David Kendall, that he provide an electronic copy of the approximately 55,000 pages identified 
as potential federal records and produced on behalf of former Secretary Clinton to the 
Department of State on December 5, 2014. (See Enclosure A) On June 15, 2015, Mr. Kendall 
replied that, pursuant to my request, he would “copy onto a disc the electronic version of the e- 
mails previously produced in hard copy to the Department on December 5, 2014.” (See 
Enclosure B) Before Mr. Kendall could provide that disc to the Department, however, we 
understand that the FBI obtained the relevant electronic media. Accordingly, we request from 
the FBI an electronic copy of the approximately 55,000 pages identified as potential federal 
records and produced on behalf of former Secretary Clinton to the Department of State on 
December 5, 2014. This request is in accordance with counsel we have received from the 
National Archives and Records Administration (NARA). (See Enclosure C) 


: | 
Additionally, to the extent the FBI recovers any potential federal records that may have 
existed on the server at various points in time in the past, we request that you apprise the 
Department insofar as such records correspond with Secretary Clinton’s tenure at the Department 
of State. Because of the Department’s commitment to preserving its federal records, we also ask 
that any recoverable media and content be preserved by the FBI so that we can determine how 
best to proceed. 


The Honorable 
James B. Comey, 
Director, 
Federal Bureau of Investigation, 
935 Pennsylvania Avenue, N.W., 
Washington, D.C. 20535-0001. 


HRC-2664 


-2- 


We thank you in advance for your attention to this matter and look forward to 
coordinating with you. : 


Sincerely, 
Enclosures: 
As stated. 


cc: James A. Baker, FBI/OGC 
Gary Stern, NARA/OGC 
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UNDER SECRETARY OF STATE 


FOR MANAGEMENT 
WASHINGTON 
MAY 22 2015 
. - CORRECTED COPY 
_ David E. Kendall, Esq. , 

Williams & Connolly LLP © 
725 12th Street, NW 
Washington, DC 20005 


Dear Mr. Kendall: 


I am writing in reference to the following e-mail that is among the approximately 55,000 pages 
that were identified as potential federal records and produced on behalf of former Secretary 
Clinton to the Department of State on December 5, 2014: E-mail forwarded by Jacob Sullivan 
to Secretary Clinton on November 18, 2012 at 8:44 pm (Subject: Fw: FYI- Report of arrests — 
possible Benghazi connection). 


Please be advised that today the above referenced e-mail, which previously was unclassified, has 
been classified as “Secret” pursuant to Section 1.7(d) of Executive Order 13526 in connection 
with a review and release under the Freedom of Information Act (FOIA). In order to safeguard 
and protect the classified information, ] ask — consistent with my letter to you dated March 23, 
2015 - that you, Secretary Clinton and others assisting her in responding to congressional and 
related inquiries coordinate in taking the steps set forth below. A copy of the document as 
redacted under the FOIA is attached to assist you in your search. 


Electronic Records 


1) Consistent with my March 23 letter, and to the extent the documents are stored electronically, 
please copy onto a digital video disc (DVD) or compact disc (CD) the approximately 55,000 
pages. If available, the Department would ask that the documents be provided in native 
electronic format with the associated metadata. These steps are in accordance with counsel 
we have received from the National Archives and Records Administration. 


2) has been made place the disc(s) in a brown envelope, seal it, address it to 
Deputy Legal Adviser, U.S. Department of State, Washington, D.C., and 
mark the word “SECRET” on the outside of that envelope. Once that is done, please notify 
us and we will pick up the envelope from your office. 


3) Once you have made the electronic copy of the documents for the Department, please 
locate any electronic copies of the above-referenced classified document in your _ 
possession. If you locate any electronic copies, please delete them. Additionally, once 
you have done that, please empty your “Deleted Items” folder. 
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Non-Electronic Copies 
1) Please locate any non-electronic copies of the classified document in your possession. 


2) Place any copies of the document that you locate in a brown envelope, seal it, address it to 
eputy Legal Adviser, U.S. Department of State, Washington, D.C., and 
mark the word “SECRET” on the outside of that envelope. Once that is done, please notify 
us and we will pick up the envelope from your office. 


Finally, please note that the classification of this document pursuant to Executive Order 13526, 


Section 1.7(d), does not in itself indicate that any person previously acted improperly with 
respect to the document or the information contained therein. 


If you should have any questions regarding the steps set forth above, please contac|__] 
[Hn the Office of the Legal Adviser. In the meantime, I ask that you confirm receipt of this 
letter as soon as possible. 


‘ 


2 truly ee 


eT a 


Patrick F. Kennedy 
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LAW OFFICES 


WILLIAMS 8&8 CONNOLLY LLP 
725 TWELFTH STREET, N.W. 


DAVID E& KENDALL WASHINGTON, D. C. 20005-5901 EDWARD SCHMRTT STLIAMS «#020-1080) 


(202) 434-5145 (202) 434-5000 
jecel 6 (ffs 


dkendall@we.com FAX (202) 434-5029 


June 15, 2015 
BY HAND 


Mr. Patrick F. Kennedy 

Under Secretary of State for Management 
United States Department of State 

2201 C Street NW 

Washington, DC 20520-6421 


Dear Mr. Kennedy: 


Thank you for your letter dated May 22, 2015, referencing an c-mail which 
former Secretary Clinton produced to the State Department on December 5, 2014 (e-mail 
forwarded by Jacob Sullivan to Secretary Clinton on November 18, 2012, at 8:44 pm 
(Subject: Fw: FYT-Report of arrests—possible Benghazi connection)). You note that this 
e-mail, while previously unclassified, was recently classified “Secret”, pursuant to 
Section 1.7(d) of Executive Order 13526, following a Freedom of Information Act review 
by the State Department. 


‘This will confirm receipt of your letter and that, pursuant to your request, 
we have located all non-electronic copics of this document in our possessi d 
them in a sealed brown envelope, addressed to Deputy Legal Adverse . Pee 
envelope was picked up by a State Department representative on May 28, 2615. 


This will also confirm that, pursuant to your request, we will copy onto a 
disc the electronic version of the e-mails previously produced in hard copy to the 
Department on December 5. 2014. We will arrange for delivery of this disc to the 
Department as requested in your letter. 


This will also confirm that, pursuant to your request, we have deleted all . 
electronic copies of this document, with the following exception. I have received 
document preservation requests pertaining to the 55,000 pages of c-mails from the House 

_ of Representatives Select Committee on Benghazi, the Inspector General of the State 
Department, and the Inspector General of the Intelligence Community (DNI). I have 
responded to each preservation request by confirming to the requestor that I would take 
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Mr, Patrick F. Kennedy 
June 15, 2015 
Page 2 


Department, and the Inspector General of the Intelligence Community (DNI). I have 
responded to each preservation request by confirming to the requestor that I would take 
reasonable steps to preserve these 55,000 pages of former Secretary Clinton’s e-mails in 
their present electronic form. I therefore do not belicve it would be prudent to delete, as 
you request, the above-referenced e-mail from the master copies of the PST file that we 
are preserving. 


Once the document preservation requests referenced above expire, we will 
proceed to make the requested deletions. This present arrangement would cover the single 
document recently classified “Secret”. Should there be further reclassifications during the 
Department’s FOIA review of former Secretary Clinton’s e-mails, it also would cover any 
such additional documents. 


We would be grateful for the return of the 1246 e-mails which the 
Department, in consultation with the National Archives and Records Administration, has 
determined not to be federal records, as referenced in the May 6, 2015 letter from 
NARA’s Paul Wester to Ms. Margaret Grafeld, Deputy Assistant Secretary for Global 
Information Services at the Department. 


Sinctrely, 


Pe) 
David E. Kendall 
DEK/bb 
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Mr. Patrick F. Kennedy 
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Department, and the Inspector General of the Intelligence Community (DNI). I have 
responded to each preservation request by confirming to the requestor that 1 would take 
reasonable steps to preserve these 55,000 pages of former Secretary Clinton’s e-mails in 
their presént electronic form. I therefore do not believe it would be prudent to delete, as 
you request, the above-referenced e-mail from the master copies of the PST file that we 
are preserving. 


Once the document preservation requests referenced above expire, we will 
proceed to make the requested deletions. This present arrangement would cover the single 
document recently classified “Secret”. Should there be further reclassifications during the 
Department’s FOIA review of former Secretary Clinton’s e-mails, it also would cover any 
such additional documents. 


We would be grateful for the return of the 1246 e-mails which the - 
Department, in consultation with the National Archives and Records Administration, has 
determined not to be federal records, as referenced in the May 6, 2015 letter from 
NARA’s Paul Wester to Ms. Margaret Grafeld, Deputy Assistant Secretary for Global 
Information Services at the Department. 


Sjncerely, 


fF 


David E. Kendall 
DEK/bb 
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Margaret P. Grafeld. 

Deputy Assistant Secretary for Global Information Services 
Bureau of Administration 

U.S. Department of State 

SA-2, Suite 8000 

515 22nd Street, NW 

Washington, DC 20522-0208 


Dear Ms. Grafeld: 


I am in receipt of your letter of April 2, 2015, responding to the National Archives and Records 
Administration’s (NARA) formal request of March 3, 2015, that you provide us with the report 

~ required in 36 CFR 1230.14 concerning the potential alienation of Federal email records created — 
and received by former ‘Secretary of State Hillary R R. Clinton. 
I appreciate. the details you have- provided reidatest however, recognizing that the situation’: 
continues-to be ‘fluid; there are currently:two major questions or concerns’ that the Departitient 


needs to address. 


First, in your response you described and forwarded key policy directives issued by the 
Department in 2014, on records management in general, including specific guidance related to 
the management of email and other electronic records of senior agency officials. Related to these 
--policies, I am requesting additional information on how the Department implemented these 
directives with senior officials. More specifically, we would like to understand the specific 
training, procedures, and other controls the Department employed to ensure the key directives _ 
were implemented. This will allow NARA to evaluate whether there are appropriate safeguards 
in Place t to Prevent the alienation of records from occurring in the future. 


Second; as ‘we have * disclissed; I wotild like’ to reiterate our request that the Department contact 


associated metadata of the approximately 55 ‘000 hard copy pages of emails provided to the 
. Sb TAR POG UT De oe wet 
NATIONAL ARCHIVES and 
RECORDS ADMINISTRATION: re tt 
8601 ADELPHI ROAD 
COLLEGE PARK. MD 20740-6001 
www.archives.gov . , HRC-26/74 


_ Department. If the Department is unable to obtain the electronic versions of these messages from 
* Secretary Clinton, I am requesting that the Department inquire with the internet service or email 
provider of former Secretary Clinton, and also of former Secretary Powell, with regard to 
whether it is still possible to retrieve the email records that may still be present on their servers. 
As stated in the OMB/NARA M-12-18 Managing Government Records Directive, Federal 
agencies are required by the end of 2016 to maintain all electronic records, including email, in 
‘their native electronic format to facilitate active use and future access. 


I am aware that there are multiple ongoing inquiries into the details of this case, including by 
Congressional oversight committees and the Department’s Inspector General, which may already 
be addressing the requests that I have made. I would therefore appreciate continuing updates on 
the current status of these activities to the extent possible, particularly where the investigations 
may reveal that the collection Secretary Clinton provided to the Department is incomplete. I also 
look forward to receiving copies of the final reports of all such investigations, as well as the 
Department’s plans for corrective action. This documentation will assist us in understanding this 
situation and the Department plans to ensure a comparable situation will not happen in the future. 


In closing, I would like to convey my appreciation for the Department's efforts in following up 
with the representatives of the former Secretary on the many concerns that have surfaced in the 
past several months. We share many of the Department’s concerns and stand ready to provide 
advice when needed on the records management issues that arise. 


I look forward to receiving your response and appreciate your continued attention to this matter. 


Sincerely, 


Vaal Wt wie if 


PAUL M. WESTER, JR. 
Chief Records Officer 
for the U.S. Government 


ce: Ambassador Patrick F. Kennedy 
Under Secretary for Management 
Senior Agency Official for Records Management 
U.S. Department of State 
Washington, DC 20520 
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: SLL Fe. NECRSATION CONTAINED 
= e HEREIN IS UN CLASS a 
GATE Cl-O3-2017 BY 2760Le7S0 Nelo: 


FD-302a (Rev. 10-6-95) 
-]- 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 10/22/2015 ®€ per FBI 
, b7C per FBI 


b7E per DOS 


On October 20, 20151 information Technology Specialist/Forensic 
Examiner (ITS/FE) of the Operational Technology Division (OTD), attempted to access the data 
on evidence item 1B26 (OTD reference “QHQ4”), a white and grey Lexar USB 3.0 thumb drive 
labeled "Dept of State 703-312-3856," using the password[______ previously provided by 


the United States Department of State (STATE) and referenced in Serial 58. 

On October 21, 2015, 7 on oe Richard Puglisi (PUGLISI) (202- 
663-0662), Special Assistant to the Deputy al, STATE, by telephone. PUGLISI 
provided the following oo to ITS/F | ee order to access the data on evidence 


item 1B26: 


b6 
b7Cc 


On October 22, 2015, ms fet the writer an email containing the 


password. 


Reference Document: Serial 58 


Investigation on__ 10/22/2015 Washington, DC 


By J | er ee eee 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


HRC-2989 


b6é 
b7¢ 


b3 
bTE 


b6 
b7c 


b6 
b7C 


HRC-2999 


; ALL 25 NEORSATION CONTAINED 
& HEBEIN IS UNCLASS a 
OSTE CUl-03-2017 BY gvbJleTel NSlioG 


FD-302a (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 11/23/2015 


b6 per FBI, DOS 


b7C per FBI 


On October 6, 2015, GENE J. DRIGGERS (DRIGGERS), Director, Computer Forensics 


Branch, United States Department of State (STATE), Office of Inspector General (OIG), Office of 


Investigations, office telephone 703-312-3856, cellular a ae email address 


driggersg@state.gov emailed the writer, Information Technology Specialist/Forensic Examiner 
(ITS/FE) f the Federal Bureau of Investigation (FBI) Washington Field Office © 


(WFO) Computer Analysis Response Team (CART). DRIGGERS provided a list of Message- 
Digest algorithm 5 (MDS) hash values corresponding to files identified by STATE during their 
review of email data. A copy of the email data was previously provided to the FBI as evidence 


item 1B26, a white and grey Lexar USB 3.0 thumb drive labeled "Dept of State 703-312-3856," as 


referenced in Serial 58. 


The attachment “File Hash.rtf’ containing the list of hash values was burned to a CD and is 


included in a 1A envelope along with a copy of the email from DRIGGERS dated October 6, 
2015. 


Reference Documents: Serial 58, Serial : ee 


Investigation on___ 10/06/2015 at Washington, DC 


File # {sant =7 Date dictated ___N/A 


By sie | ee ee 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


HRC-3000 


b3 
b7E 


b3 
b7E 


b6 
b7C 


BUREAU OF INV! 


PAGE INFORMATION SHEET 


FEDERAL 

FOI/PA 

DELETED 

FOI/PA# 1353814-0 
Total Deleted Page(s) 
Page 1 Duplicate; 
Page 2 Duplicate; 
Page 3 Duplicate; 
Page 4 Duplicate; 
Page 5 Duplicate; 
Page 6 Duplicate; 
Page 7 Duplicate; 
Page 25 ~ Duplicate; 


ESTIGATION 


8 


XXXXKXXXXKXXKXXKX XX XK XKXXK XXX 


xX Deleted Page(s) x 
xX No Duplication Fee X 
xX For this Page % 


XXXXKXXXXKXXKXXK XX KK XXXK XXX 


Serials ee 


b7E 


ECLASS FIED By HSiD>G Ceeweoeal 
ON Oe-ls-2019 


SECRETHNOFORN 
Deriv : Multi Tces 
Classify On: 


Filing and Security Vv 


Primary Case: [ (T}-Case Title: XS//NF) MIDYEAR b3 
b7E 


EXAM; MISHANDLING 
OF CLASSIFIED; 
UNKNOWN SUBJECT 
OR COUNTRY; 
SENSITIVE 
INVESTIGATIVE 
MATTER (SIM) 

Serial Number: 195 


Serialized: 04/19/2017 


Category: Full Investigation 
Initiated: 07/10/2015 


Referenced By: [| 


= Lead5 


i_¥ 


eae 
ea overage b7E 


Details v 


{T}--pocument Title: {#4} Document Storage of TOP SECRET//SPECIAL ACCESS PROGRAM 
Evidence 


if} Synopsis: }@44 To document the storage of TOP SECRET//SPECIAL ACCESS 
PROGRAM evidence. 


{U}--~Details: - 26NF) 
{Peon SGN Evidence items 1B75, 1B76, 1B77, and 1B78 contain information 
classified at the TOP SECRET//SPECIAL ACCESS PROGRAM level and can 
only be handled by individuals read on to the programs. As a result, the items 
identified above are stored with Cl-13 in a safe located in the limited access 
eee This communication documents the location and requests IS-4 
update the evidence logs with this information and remove their charge out 
status. 


b7E 


Indexing Vv 


HRC-13772 
1 of 2 2/4/2019 2:51 PN 


Serials 


Intelligence 


Intelligence Value: 
Potential IIR/SIR? 
Sentinel Tags: 


Can you identify the 


source of this 
information? 


Routing 


From: 
Drafted By: 
Approved By: 


of 2 


No Entities to display. 


No Intelligence Value 
No 
No Sentinel Tags Selected 


No 


WASHINGTON FIELD, WF-CI13 


a, 


b7E 
Vv 
Vv 
b6 
b7C 
HRC-13773 


2/4/2019 2:51 PM 


Sentinel Working Copy 


Evidence Details 


item: 1B75 


[oo 


b7E 


DECLASSIFIED By bSlUG  G&GnwaGell 
ON 02-15-2015 


b3 
b7E 


4 od Description: One 8 GB Patriot Memory Supersonic XT USB Drive, Black in Color, 
contains CART Working Files. 


Collected On: 03/22/2016 08:08 AM EST 
Receipt Item #: None 
CATS ID#: None 
FBI Seizure #: None 


Digital Information 


Type: SD Card/Flash Drive 
Batteries Charged: No 
Number Collected: 1 
Collected by CART: No 


Discovery Location 


Area: Mi 
Seizing Individual: 
Specific: LAU 


Anticipated Disposition 


None on None 


Storage Information 


Holding Office: WASHINGTON FIELD 


Location: NA —- Retained by Agent 
Barcode #: £5490350 


Chain of Custody 
Shipping / Transfer Log 
History 


Acquisition Event Details 


ty Perce Acquisition Event: (& Mid Year Exam 


(U) ~ cotectearrom: [id 


Receipt Given: No 
Holding Office: WASHINGTON FIELD 


Evidence Log: 
Serial 199 


of 1 


Special Handling: None 


Hazardous Materials: None 


Collected By: 
Others: None 
Others Agency: None 


Last Inventory: None 


b6 
b7C 


b6 
b7C 


b6 
b7C 


b3 
b7E 


HRC-137/4 
4/18/2016 12:39 PM 


ALL [NPUCRRATION CONTAINED 
HEREIN IS UNULASSIP IE) 


DATE G2-1s-2015 By Coenw4enll Hs 


EVIDENCE CHAIN OF CUSTODY 
Time 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
= oe Time athe Time 
Signature: 


Signature: 
Printed Name/Agency: Printed Name/Agency: 
Time Time 


Relinquished Custody 


Date and 
Time 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Relinquished Custody Date and 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: 
Time 
Signature: . 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
oe Time Time — 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: 


Relinquished Custody Date and | Accepted Custody ‘Date and 
Po Time Time 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 


Relinquished Custody 


Date and | Accepted Custod 


[SPW ee ee ne 


Signature: Signature: 


Printed Name/Agency: Ld Printed Name/Agency: 
Reason: 
; Time 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
; Time Time 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 


Relinquished Custody Date and | Accepted Custody Date and 
i Time Time 


Signature: Signature: 
Printed Name/Agency: 


Printed Name/Agency: 
Reason: 


Reason: 


Case ID: IB: Barcode: 


HRC-13775 


co 


Reason: “J 6 Sete 
oo 
Time 
Signature: Signature: 


Reason: 


Relinquished Custody Date and Accepted Custody ae weeds _ | Date and 
| Time ‘Time ~ 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 


Relinquished Custody ; Date‘and | Accepted Custody 
‘ ; ‘Time . ; 


| Signature: Signature: 


Printed Name/Agency: Printed Name/Agency: 


Reason: 


Relinquished Custody Date and | Accepted Custody ‘Date and 
Time _..iCime 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 


Reason: Reason: 


Relinquished Custody Date and | Accepted Custody Date and. 
i: Time et | ‘Time 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 


Reason: 


ATF Trace Form Completed: [_] 


Firearm Certification by (PFI/SWAT) / Explosive Material Certification by (SABT): 


Printed Name: 


NCIC: 


Signature: 


Date: 


rere 
a a! 
Case ID: : Barcode: cE OH 4 es O 


b3 
b7E 


HRC-13776 


b7E 
Sentine] Working Copy 


~ DECLASSIFIED BY. NSIC Cés4ceil 
: ON 02-12-2019 
Evidence Detaiis 


Case: Item: 1876 b3 
b7E 


(es Description: Clone of QHQ14/1B48 
Collected On: 03/22/2016 08:08 AM EST 
Receipt item #: None Special Handling: None 
CATS ID#: None Hazardous Materials: None 
FBI Seizure #: None 
CATS Abandonment#: None Abandonment #: None 
{ yaa aati Late Justification: ?&) FD-1087 was not submitted until 4/18/16. 


Digital Information 


Type: Hard Drive 
Batteries Charged: No 
Number Collected: 1 
Collected by CART: No 


Discovery Location 


Area: Mission Ridge Facility 


Specific: TAU . Others: None b7c 
Others Agency: None 


Anticipated Disposition 


None on None 


Storage Information 


Holding Office: WASHINGTON FIELD 


Finalized ef Last Inventory: None a 


Location: NA - Retained by Agent 
Barcode #: E5490351 


Chain of Custody 
Shipping / Transfer Log 
History 


Acquisition Event Details 


th cans Acquisition Event:---PS{ Mid Year Exam 


it} Panik: Collected. From: > | b6 
ae b7c 


Receipt Given: No 


Holding Office: WASHINGTON FIELD 


b3 
b7E 


Evidence Log: 
Serial 159 


HRC-13777 
of | 4/18/2016 12:42 PM 


cE deer benteieterterhentierdenretabdiere” 2 


b6 
b7Cc 
Relinquished Custody - pie Date and | Accepted. Custody ; | Date and. 
Soy eee : es - ey cere! : oo Time” 
Signature: Signature: 
Reason: Reason: 
Relinguished Custody Accepted Custody ; -Date and 
Time ee ee ‘Time. 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
Relinquished:Custody. Accepted Custody an ' See be ‘Date and 
Time ; ; °°) Time: 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
Relinquished Custody Accepted Custody ‘Date and. 
Time Time - 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
vf Time. Joo Aime 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
Firearm Certification by (PFI/SWAT) / Explosive Material Certification by (SABT): ATF Trace Form Completed: [] 
Printed Name: NCIC: [] 
Signature: 
b3 


Case I 1B: Ta Barcode: ES4 05 o| Pe 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASS if 
DATE Ce-le-2015 By CoeWweeRll NSIOG 


HRC-13778 


Sentinel V-orking Copy 


~ 


Evidence Details 


Case: 


{- es Description: 


Collected On: 

Receipt Item #: 

CATS ID #: 

FBI Seizure #: 

iy CATS Abandonment #: 
1 


Digital Information 


Type: 
Batteries Charged: 
Number Collected: 
Collected by CART: 


Discovery Location 


Ss 


DELLASS 
ON G2-1s-2019 


Item: 1B77 


OR Containing a forensic image of QHO3 (BP Server), QHQ8 (VM's form 
PRN Server), QHOS (BP external drive), and QHQI2 (PRN Server) 


03/22/2016 08:08 AM EST 
None 


Special Handling: None 


None Hazardous Materials: None 


None 
None 


Abandonment #: None 


~(BK FD-1087 was not submitted until 4/18/16. 


Hard Drive 
No 

1 

No 


Area: Mission Ridge Facility 
Seizing Individual: 


Specific: 


TAU 


Anticipated Disposition 


None on None 


Storage Information 


Holding Office: 


WASHINGTON FIELD 


Location: 


Barcode #: 


Chain of Custody 
Shipping / Transfer Log 


History 


NA - Retained by Agent 


E5490353 


Acquisition Event Details 


Receipt Given: 
Halding Office: 


Evidence Log: 


of 1 


Ae quisition Event: 


eae Mid Year Exam 


No 


WASHINGTON FIELD 


Others: None 


Others Agency: None 


Last Inventory: None 


7) BY WSU Ceewaobll 


b7E 


b3 
b7E 


b6 
b7C 


b6 
b7c 


b6 
b7C 


b3 
b7E 


b6 
b7c 


Reason: ~ /é Reason: 


Date and | Accepted Custody ; | 
Time | 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 


Reason: 


Relinquished Custody | Date and Accepted Custody : Date and 
o Time : ; . A Time: 
D 


Reason: 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
: Reason: 
Relinquished: Custody | Accepted Custody She Date and 
Time - | Time 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 


Reason: Reason: 


Relinquished Custody ; Accepted Custody 
oa ne Time 


Signature: Signature: 


Printed Name/Agency: Printed Name/Agency: 


Reason: Reason: 


Relinquished.Custody Date and | Accepted Custody ‘Date and 
. se Time , Time 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: 


Firearm Certification by (PFI/SWAT) / Explosive Material Certification by (SABT): ATF Trace Form Completed: L] 
Printed Name: Ncic: [] 


Signature: 


b3 


Case ID: 1B: qt Barcode: E5490553 b7E 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSI o 
DATE O2-13-2015 By Coew4eBl1 NSICG 


HRC-13780 


Sentinel Working Copy 


Evidencg Details 


eee 


ce Ceaenli b7E 


0 ASSIFIED Be AS 


GH Uf-ls-2019 


ha pooeeeeee Description: tat One 4 TB Western Digital Hard Drive Labeled DEHQ3, Model b7c 
Collected On: 03/22/2016 08:08 AM EST 
Receipt Item #: None Special Handling: None 
CATS ID#: None Hazardous Materials: None 
FBI Seizure #: None 
CATS Abandonment #: None Abandonment #: None 
4th peanan ciel Late Justification: Ox FD-1087 was not submitted until 4/18/16. 
4 
Digital Information 
Type: Hard Drive 
Batteries Charged: No 
Number Collected: 1 
Collected by CART: = No 
Discovery Location 
Area; Mission Ridge Facility b6 
Seizing individual: cee Collected By; 
Specific: TA Others: None b7c 
Others Agency: None 
Anticipated Disposition 
None on None 
Storage Information 
Holding Office: WASHINGTON FIELD 
Finalized yf Last Inventory: None b6 
b7c 
Location: NA ~ Retained by Agent 
Barcode #. £5490355 
Chain of Custody 
Shipping / Transfer Log 
History 
Acquisition Event Detaits 
it pean Acquisition Event: ) Mid Year Exam 
a ‘ 
FBI b7C 
Receipt Given: No. 
Holding Office: WASHINGTON FIELD 
Evidence Log: [___ Be 
b7E 


Serial 159 


of | 


HRC-13781 
4/18/2016 12:44 PM 


Bj22] X4} Signature: : b7c 


Printed Name/Agency: . oa 


; wn s Z Date and 
; : : a Stay Time 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 


Relinquished Custody “| Dateand’| Accepted Custody = sl Date and 


Reason: 


Relinquished Custody 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 


-Relinquished Custody . Date and Accepted Custody 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 


Relinquished:Custody’ ate and | Accepted Custody ; Date and 
fest ve Time a Te Time 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 


Reason: Reason: 


Relinquished Custody ‘Date and Accepted Custody sade Bi . _. | Date and 
ae ; | Time: othe oo Time 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 


Firearm Certification by (PFI/SWAT) / Explosive Material Certification by (SABT): ATF Trace Form Completed: 


Printed Name: NCIC: [7] 


Signature: 


Date: 


Case fo | 1B: FP Barcode: E54 50 b oo. a 


ALL INFORMATION CONTAINED 
HEREIN [5 UNCLASSINVI 
DATE Oe-le-2013 BY Ceeweesil NSlo: 


HRC-13782 


Serials 


Filing and Security 


[Serer 


b7E UzULAss OB: NSIC CosniGkil 


ON O2-18-2019 


SECRETHNOFORN- 
Defi : Mul rces 
assify On: 31 
Vv 


Primary Case: — {J} Case Title: {SGNF)}MIDYEAR 
EXAM; MISHANDLING 


Serial Number: 
Serialized: 


Category: 
Initiated: 


Referenced By: 


Details 


(T}-~-Document Title: 


1} Synopsis: 


i 


Indexing 


1 of 2 


it aay Details: 
ay 


OF CLASSIFIED; 
UNKNOWN SUBJECT 
OR COUNTRY; 
SENSITIVE 
INVESTIGATIVE 
MATTER (SIM) 

196 


04/20/2017 


Full investigation 
07/10/2015 


Lead 6 = Lead 6 Coverage 


-(R/NFy Document Storage of TOP SECRET//SPECIAL ACCESS PROGRAM 


Evidence 


(SINE) To document the storage of TOP SECRET//SPECIAL ACCESS 
PROGRAM evidence. 


RUN 


. (SINE) Evidence item 1B79 contains information classified at the TOP 
SECRET//SPECIAL ACCESS PROGRAM level and can only be handled by 
individuals read on to the programs. 9 is stored with Cl-13 in safe 

ocated in the limited acces: room. This communication 
documents the location and requests IS-4 update the evidence log with this 
information and remove 1B79's charge out status. 


HRO137 


b3 
b7E 


b3 
b7E 


bT7E 


51 PN 


b7E 


No Entities to display. 
Intelligence v 
Intelligence Value: No intelligence Value 
Potential IIR/SIR? No 
Sentinel Tags: No Sentinel Tags Selected 
Can you identify the No 
source of this 
information? 
Routing Vv 
From: _WASHINGTON FIELD , WF-CI13 
Drafted By: b6 
Approved By: SS b7Cc 
HRC-13784 


1 of 2 2/4/2019 2:51 PM 


Sentinel Working Copy | 


£2, 8 b7E 
a DECLASS OD By HSlo] CbendGel 
ON O2-13-2013 


Evidence Details 


b6 
ie od Description: og One 500 GB Seagate Barracuda Hard Drive Labeled DEHQ55 S/N b7c 
containing forensic images of QHQ1 (1B1) and QHQ2 (1B2) bIE 
Created for IAU Review 
Collected On: 02/02/2016 01:00 PM EDT 
Receipt Item #: None Special Handling: None 
CATS iD#: None Hazardous Materials: None 
FBI Seizure #: None 
CATS Abandonment#: None Abandonment #: None 
Late Justification: (U) FD-1087 was not received until 4/19/16 
Digital Information 
Type: Hard Drive 
Serial Number: b6 
Batteries Charged: No b7C 


Number Collected: 1 
Collected by CART: No 


Discovery Location 


Area: FBI/OTD 
Seizing Individual: [_____] coltectedBy:[ i b6é 
Specific: NA Others: None b7c 
Others Agency: None 


Anticipated Disposition 


None on None 


Storage Information 
Holding Office: WASHINGTON FLELD 


Finalized CY Last Inventory: None b6 


b7Cc 
Location: NA ~ Retained by Agent 
Barcode #: £5490352 
Chain of Custody 
Shipping / Transfer Log 
History 
Acquisition Event Details 
47} ee Acquisition Event: 9x) Mid Year Exam 
4} eesti Collected From:--}X) IT Specialist/Forensic Examiner [ b6 
FBI b7Cc 


Receipt Given: No 


Holding Office: WASHINGTON FIELD 


Serial 160 b7E 


HRC-13/785 


of | 4/19/2016 11:32 AM 


Printed Name/Agend 


Relinquished Custody ) Date and 


Signatur 


Printed Narne mm | eT : Printed Name/Agend 
WA : TAG 


ee ” ee 
Reason: /e Ack AA brenT 
Relinquished ‘Custody 


Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 


Relinquished Custody 7 is ‘Date and 
1 /Time 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 


Reason: Reason: 


Relinquished.Custody _ ‘Date and 
: | Time 


Printed Name/Agency: 
Reason: 


Relinquished ‘Custody: 


Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 


Firearm Certification by (PFI/SWAT) / Explosive Material Certification by (SABT): ATF Trace Form Completed: L] 
Printed Name: NCIC: [] 
Signature: 


Date: 


Case ID: 1B: Barcode: 


ALL INEORMATION CONTATNED 
HEREIN [5 UNCLASSIFIED 
DATE G2-ls-2019 By Ceeweeell Slo 


HRC-13787 


FEDRKRAL BUREAU OF INVESTIGATION 
FOI/PA 
DELETED PAGE INFORMATION SHEET 
FOI/PA# 1353814-0 


Total Deleted Page(s) = 2 
Page 1 ~ Referral/Consult; 
Page 2 ~ Referral/Consult; 


XXXXKXXKXXAKXXKXXAX XX KK XA XK XXX 


Xx Deleted Page(s) x 
xX No Duplication Fee X 
Xx For this Page Xx 


XXXXKXXKXXKXXKXXKX XX KK XKXXK XXX 
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